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Preface 



The Advisory Committee on Major Hazards was set 
up by the Health and Safety Commission towards the 
end of 1974 to consider the safety problems associated 
with large-scale industrial premises where potentially 
hazardous operations are conducted. 

The Committee’s first two reports, published by the 
Commission in 1976 and 1979 respectively, made 
important contributions to informed discussion and 
public awareness of the safety of hazardous industrial 
operations in this country. The reports included 
recommendations for a fairly wide notification scheme 
for major hazards, associated planning controls and 
hazard surveys. 

This third report reviews the development of the main 
themes from its predecessors and presents a 
consolidated view of progress. It concentrates on the 
measures needed for the control over potential major 
hazards. The Commission welcomes the report as 
making a further important contribution to thinking in 
this fi&ld. 

This is the Committee’s final report as its remit came 
to an end in December 1983. Over the previous 9 years 
the expert views of a large number of people with 
different and often conflicting interests in this diverse 
and complex subject have been merged together. The 
ACMH has left us with much food for thought for the 
future and in particular directed our immediate 
attention to the potential hazards arising from the 
transport of large amounts of dangerous substances. 
The Commission has accepted this concern and has 
directed the HSE to examine how best to deal with 
this important aspect. 

As well as the three reports, concrete results of the 
Committee’s work are seen in the existence of a 
specialist unit in the HSE to deal with major hazards, 
the Notification of Installations Handling Hazardous 
Substances Regulations 1982, the forthcoming changes 
in planning controls and the implementation of the 
European Commission Directive on Major Accident 
Hazards: all these stem from the seminal work of the 
Committee. 

Dr E J CULLEN 

Chairman Health and Safety Commission 
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Foreword 



Our first 1 and second 2 reports to the Health and Safety 
Commission were published in 1976 and 1979 
respectively. In these we set out to identify and obtain 
an understanding of the problems associated with the 
control of major hazards and we suggested a 
framework of legislative and other methods within 
which these problems could be contained. In this Our 
third report we are concerned with the measures 
needed for their control. Of prime importance is the 
need for a better understanding by the general public 
of the nature of the risk imposed by major hazards 
and the methods taken to minimise and restrict them. 

The main part of the report deals with the major 
issues to be considered in the control of major hazards 
and discusses various aspects of achieving improved 
control. The appendices cover various topics including 
scientific research and technical papers. These 
appendices have largely been the work of our sub- 
committees and many of our conclusions and 
recommendations in this report are based on this 
work. 

The work of the sub-committees has been assisted 
greatly by co-opted members from industry and 
elsewhere and we gratefully acknowledge their 
contributions. The Health and Safety Executive (HSE) 
has also been of great assistance to us on a continuing 
basis and we would offer thanks to the many officers 
of the HSE who have generously helped us. Finally, 
we must record that all our deliberations have been 
aided by the outstanding contribution of our secretary 
and his staff, not only in relation to the day to day 
work of the committee, but also and not least in the 
preparation of this report. To them we offer special 
thanks. 
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The control of major hazards 



1 The overal 1 [ re" 'em 



1 This report continues to deal with our task of 
considering those installations which could present a 
major threat to the safety of employees or the general 
public from explosion, the release of toxic substances, 
or catastrophic fire*. 

2 The phrase ‘major hazard’ was coined in the 
context of possible accidents in chemical or other 
industrial installations handling dangerous substances 
which might cause extensive damage and kill or injure 
persons within or outside the site boundary. Interest 
and alarm were generated not least because the 
potential off-site effects raised new questions about the 
measures that existed or could be introduced to ensure 
the safety of members of the public in the vicinity of 
such installations. 

3 The aspect central to our discussions has been the 
question of risk. Much has been written about risk in 
recent years, and it would be easy to think that risk is 
something new that we have invented in the last few 
decades. On the contrary, man has always had to live 
with risk, and each generation has had to come to 
terms with its own particular, and often new, problem. 
We believe it to be sensible to take the attitude that 
the risks from modern technological processes should 
not be the dominant risks for a worker or the public; 
indeed that they should not add significantly to the 
risks from all sources to which each of us is exposed 
throughout his life. This is discussed more fully in the 
next chapter, and much of what follows is concerned 
with the practical, and essentially commonsense, 
measures which can be taken to achieve a low level of 
risk. 

4 Our 1976 and 1979 reports set out the problems 
involved, and suggested legislative and other measures 
to control or contain them. We suggested ways and 
means of identifying those activities which posed the 
greatest potential hazards to both workers and the 
public at large, and stressed the need for improved 
controls over the design, operation and siting of such 
activities. We recognised that absolute safety was 
impossible to achieve and in order to provide an 
adequate system of control, made a number of 
recommendations most of which we are pleased to 
note have been acted upon. The introduction of the 
Notification of Installations Handling Hazardous 
Substances Regulations 1982 (hereinafter referred to as 
NIHHS Regulations) by the Health and Safety 
Commission (HSC) which we recommended in our 

* See Glossary for definitions, acronyms and abbreviations used in 
this report. 
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first report together with proposals for changes in 
planning legislation by the Department of the 
Environment (DoE) and the Scottish and Welsh 
Offices are seen as important achievements in the 
control of major hazards. The identification of the 
substances which would pose the greatest threat to 
safety and the choice of threshold quantities for them 
have been difficult, but we hope and believe that our 
judgements have gone some way towards achieving a 
reasonable degree of equivalence of hazards. 

5 The European Community Directive on the Major 
Accident Hazards of Certain Industrial Activities 3 
(hereinafter referred to as the Directive) was adopted 
by the European Community in June 1982. Although 
we have reservations about some proposals in detail, 
we are pleased that many of the Directive’s 
requirements stem from and reflect our views in the 
earlier reports. This Directive requires further controls 
over larger quantities of the hazardous materials listed 
in the NIHHS Regulations. It also extends controls to 
other, similar hazardous substances and to a large 
number of toxic chemicals as well. The main 
provisions of the Directive include duties on the 
person in control of specified activities using scheduled 
substances to make a report to the competent 
authority (in this case the HSE) identifying the major 
accident hazards and the measures taken to prevent 
them, or to control and minimise their consequences; 
to draw up an emergency plan for use within the site 
and to provide information for dissemination to 
members of the public who might be affected by an 
accident at the site. The Directive also requires a 
competent authority to draw up an emergency plan for 
use outside the site. A summary of the main provisions 
of the Directive is given in Appendix 3. The Directive 
will be implemented by the Control of Industrial 
Major Accident Hazards Regulations. 

6 However sound the statutory requirements are, or 
excellent the technology, unless society in general has 
confidence in them, effective control will not be seen 
to be achieved. This is particularly true for major 
hazards, and it therefore is our view that open debate 
should be encouraged at all levels. The point is made 
that people who are liable to be affected by a major 
hazard installation should have information made 
available to them on the hazards and the control 
measures. The problems are by no means simple and 
these are considered more fully in Section 2. 

7 This report is entitled The Control of Major 
Hazards and we consider there to be four basic 
elements of a control scheme. Firstly, it is necessary 
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that activities with the potential for creating a major 
hazard can be identified. Since 1 January 1983 
HSE is provided under the NIHHS Regulations with 
details of all installations defined as hazardous. 
Secondly, when dealing with any activity which might 
be dangerous it is essential to recognise the potential 
hazards and the ways they might be realised, and to 
assess them. We deal with these topics in Section 3. 
Thirdly, one should try to eliminate or avoid the 
potential hazard, but if this is not reasonably 
practicable then every attempt should be made to 
reduce the probability of its occurrence or its scale. 
These matters are discussed in Section 4. Fourthly 
once identified and assessed, the hazardous installation 
and its relationship to the surroundings can be 
examined. In Section 5 we consider proposals for 
technical guidelines which HSE is developing as the 
basis for its advice to the planning authority to take 
into account with all other factors when it makes its 
planning decisions about such developments. This 
section also discusses the means that could be taken to 
mitigate the consequences of a potential major 
incident. Our views on proposals by the DoE to 
improve the control of development both at and in the 
vicinity of such installations are set out in Section 6. 

8 In developing the hazard controls which we 
describe in this report we have aimed throughout at a 
system which is robust. We have sought to achieve this 
by using a variety of measures which complement and 
support each other and which avoid excessive reliance 
on any single one. This is the approach which has 
been used with great success in the detailed reliability 
engineering of hazardous plants and other high 
technology systems and we think it is equally 
applicable to the overall system of hazard control. 

9 The education in matters of safety of those 
involved in major hazards is essential and must 
continue. Our views are given in Section 7. 

10 Continued research into factors affecting major 
hazards is necessary. This will contribute to a better 
understanding of the causes of accidents involving 
major hazards and enable safer designs or procedures 
to be adopted. It may also allow some of the 
calculations in the assessments to be made with less 
pessimistic assumptions. 

1 1 The transport of dangerous substances is a matter 
of growing concern and we have taken this 
opportunity of including our 1982 Report on this to 
the HSC as Appendix 2. Our Report makes a prima 
facie case that there are aspects of the transport of 
dangerous substances in large quantities which merit 
the same degree of attention that is paid to similar 
quantities in static installations. The main aspects that 
we highlighted for further consideration include: 



(a) the need for hazard surveys for large quantities 
of hazardous substances in transport including 
any intermediate storage facilities; 

(b) the need for planning controls for transit depots 
and loading or unloading sites and for nearby 
developments, similar to those being introduced 
for other notified sites, and 

(c) the system of control and responsibilities for 
safety in ports and harbours handling major 
hazard quantities of hazardous substances. 

The Commission has agreed that the areas we 
identified as requiring further study should be followed 
up. 

12 In our earlier reports we recommended that there 
should be further investigations into the causes, 
behaviour and consequences of dust explosions and 
catastrophic fires, including fireballs, fire storms and 
the so-called ‘domino effect’. Appendices 8 to 10 
describe the results of our work and our principal 
conclusions are that: 

(a) Although fireballs are a well-established 
phenomenon, further work is necessary to 
develop improved methods of predicting their 
effects. 

(b) Fire storms are unlikely to occur as a result of 
conventional fires in modern industrial plant. 
However, the effect of large scale spillages of 
liquid oxygen merits further investigation. 

(c) Dust explosions usually have only local effects. 
The hazards appear to be well controlled by 
Section 31 of the Factories Act 1961, which is 
now part of the Health and Safety at Work etc 
Act 1974 (hereinafter referred to as HSW Act). 

(d) Anyone operating a major hazard plant should 
consider the effects of major accidents on other 
plants on the site or nearby sites (the so called 
domino effect); all those affected should plan 
accordingly to minimise the consequences. 

13 Since our last report a fire occurred at Morley 
near Leeds as a result of which toxic chemicals were 
released into a water course. After studying all 
available information on the incident we decided there 
were a number of issues on which we would like to 
express our concern. A brief report is at Appendix 4. 

14 We have also included as Appendices 5, 6, 7, 12, 
13 and 14 accounts of some of the various research 
projects that we have learned about since our last 
report. 
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The control of major hazards 



2 Living wit ;i risk 



15 We are all throughout our lives subject to risks. 
Some are perhaps inescapable and must therefore be 
accepted; others might be reduced in frequency or 
magnitude sometimes at the cost of eliminating 
compensating benefits. It is our view that the principle 
of balancing the efforts required to reduce risk against 
possible gains has been part of our common duty of 
care for generations and is certainly part of the 
concept of “reasonably practicable” in the HSW Act. 
We think that the same approach should be followed 
in the field of major hazards. 

16 The obverse of risk is of course reliability and it is 
with the reliability of major hazard installations that 
we have been concerned. The duty laid upon 
employers by the HSW Act requires employers to 
ensure, so far as is reasonably practicable, the health, 
safety and welfare at work of their employees. The Act 
also requires employers to conduct their undertakings 
in such a way as to ensure, so far as is reasonably 
practicable, that other people who may be affected are 
not exposed to undue risks to their health or safety. 

17 “Reasonably practicable” has been defined by the 
Court of Appeal and we think it valuable to repeat the 
definition here. In the case of Edwards versus the 
National Coal Board (1949) 4 Lord Justice Asquith 
interpreted “reasonably practicable” to imply that a 
computation must be made in which the quantum of 
risk is placed in one scale and the sacrifice involved in 
the measures necessary for averting the risk (whether 
in money, time or trouble) is placed in the other, and 
that, if it be shown that there is a gross disproportion 
between them — the risk being insignificant in relation 
to the sacrifice — the defendants discharge the onus 
upon them. Moreover, this computation falls to be 
made by the owner at a point in time anterior to the 
accident. The wording of the HSW Act is no more 
than a restatement of fhe duty of care under the 
Common Law which applies to us all. It is clear that 
in some circumstances the High Court ruling would 
prohibit the activity altogether if the risk could not be 
controlled within financial limits which were 
commercially acceptable. In our 1976 report we 
suggested tentatively that there was a level of risk or 
reliability, as the case might be, which we saw as the 
lower limit of acceptability. It made clear also that 
there were circumstances and conditions where higher 
levels of reliability would be both reasonable and 
practicable and this was a matter which would have to 
be judged in each individual case. The duty of care on 
individuals and the statutory duties laid on employers 
both provide for “reasonable and practicable 

10 



measures”, and these by the very nature of the 
judgement referred to above will vary with the 
intensity and magnitude of the risk, becoming 
increasingly onerous with each increase in risk; 
with that in mind we think there is no need to go 
further. It does not therefore seem feasible to us to 
attempt to lay upon individuals or corporations 
“duties” which they cannot discharge. It would not be 
helpful to “require” a major hazard plant to be “safe?’. 
It is true that in safety legislation, absolute duties in 
some cases have been laid upon employers; for 
example the fencing of dangerous machinery under the 
Factories Act. However it is notable that the courts 
have interpreted this duty as being modified by what is 
“foreseeable” as to danger. From the point of view of 
major hazards the case of Bolton v Stone (195 1) 4 is 
relevant. In this case Lord Porter observed: “Nor is 
the remote possibility of injury occurring enough. 

There must be sufficient probability to lead a 
reasonable man to anticipate it. The existence of some 
risk is an ordinary incident of life, even when all due 
care has been, as it must be, taken.” The judgement is 
interesting in that the phrase “sufficient probability” is 
here used, in a legal context. 

18 The use of the word “probability” can also infer 
the quantification of the likelihood of given events 
which, with the assessment of the potential 
consequences of the hazards, have been of particular 
interest and study in recent years. We deal with the 
subject of quantitative assessment in the next section 
where we consider use of quantification techniques to 
achieve a greater understanding of hazards and risks 
and hence the ways in which they can be avoided. 

Much has been written on the subject and it is one on 
which many disciplines have a contribution to make. 
However the results of quantification must be seen in 
context and treated with caution and proper 
understanding. 

19 In dealing with the risks the decision-maker needs 
to take into account the different perceptions of risk 
and to be mindful of the many facets of the risk 
problem. It is not appropriate to treat particular 
figures as rigid limits of acceptability or to take too 
mechanistic an approach. The problem of risk was 
discussed in a 1983 Report by the Royal Society. 5 The 
following quotation from the section on “Possible 
quantitative guidelines” summarises some of the factors 
which need to be considered: 

“With all this in mind, it still seems worth discussing 
some typical figures which Government or regulatory 
agencies could bear in mind, both in judging the 
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impact of individual hazards, and in judging whether confidence obtained from the safety assessments, the 
risks of catastrophe are tolerable or not. benefits and the availability of alternative processes. 



“Such figures can be no more than broad guidelines 
to the decision-maker for several reasons: 

(a) Each case must be regarded on its merits. 
Significantly different quantitative guidelines 
might well apply to different situations. 

(b) The figures must necessarily refer to objective 
estimates of risk. But since individual perception 
(and indeed individual estimation of risk) covers 
such a wide range, a rational central decision, 
even if further modified by some allowance for 
differences of perception is bound to leave some 
people considering that they are at undue risk. 

(c) The individual perception of being at risk is 
likely to be reduced by consciousness that efforts 
are being made to improve the situation. 

(d) The central decision-maker may take a different 
view from that of the industrialist whose risks he 
needs to regulate. He may well impose controls 
which are more stringent than appear necessary 
to the industrialist. But this need not always be 
so. For one thing, government action may be 
unduly delayed; for another, a manufacturer will 
often, in his own interests, wish to control 
stringently a commercial product which might 
react on the manufacturer’s good name or an 
individual’s conscience. 

“With all these qualifications, the decision-maker 
should have in mind an upper value for the risk 
associated with particular hazards which must not be 
exceeded. If an activity cannot be controlled so that 
the risk comes below that level of risk in a reasonable 
time, it should be stopped. By contrast, there is almost 
certain to be a lower level of risk, below which further 
control would be a wasteful deployment of resources. 
This level appears as a trivial one to the decision- 
maker — though it may not appear trivial to some of 
the individuals at risk. For certain hazards which are 
very salient in the public mind, significant sections of 
the population may continue to be concerned, 
whatever the level of risk, however small. The 
decision-maker has to bear this in mind, but in our 
view it is between these upper and lower limits that the 
risks, detriments, costs, and benefits need to be 
related, and the concept of control ‘so far as is 
reasonably practicable’ becomes relevant.” 

20 We believe that there is less scope in setting a risk 
criterion than is sometimes acknowledged in 
discussions of the subject. Most major hazard risks fall 
in the band between the clearly unacceptable and the 
clearly negligible. Within this band there is a region of 
uncertainty and the acceptance of a particular 
situation will depend upon a whole range of factors. 
These might include such aspects as whether the plant 
is a new or an existing installation, whether it is a 
single or multiple installation, the siting, the level of 



21 In the context of the control of major hazards we 
believe that there is widespread support for the 
following propositions. 

(a) The risk from a hazardous installation to an 
individual employee or member of the public 
should not be significant when compared with 
other risks to which he is exposed in everyday 
life. 

(b) The risk from any hazardous installation should, 
whenever reasonably practicable, be reduced. 

(c) Where there is a risk from a hazardous 
installation, additional hazardous development 
should not add significantly to the existing risk. 

(d) If the possible harm from an incident is high, the 
risk that the incident might actually happen 
should be made very low indeed. This takes 
account of society’s particular abhorrence of 
accidents which cause many simultaneous 
casualties. 

Information to the public 

22 It seems inescapable to us that if the public are to 
be expected to live with risks from some industrial 
installations, however well controlled, they should be 
made aware of those risks. But there are considerable 
practical problems: what information should be given; 
who should be told; who should do the telling, and, by 
no means least, for which installations should 
information be given? 

23 As to what information should be given to the 
public nearby, we think that the minimum information 
given should include: 

(a) the nature of the hazards which might affect 
them if control measures fail; 

(b) the emergency arrangements which have been 
made in advance, and 

(c) what they should do in a major incident. 

24 When it comes to deciding who should be told we 
think there are three broad categories. 

(a) Employees and others on the site. 

(b) Local planning authorities and emergency 
services. 

(c) Members of the public Who live in the vicinity of 
a hazardous installation. 

25 There are no difficulties about informing 
employees and others on the site, since those 
concerned are covered by the duties and requirements 
of the HSW Act. There are no great difficulties either 
with the local planning authorities and emergency 



services, since Section 28 of the Act allows the HSE to 
pass on the necessary information. The NIHHS 
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made arrangements to pass information about a 
notified installation to the local authority’s planning 
department and fire service. The remainder of the 
answer to the question ‘who should be told’ is less 
straightforward. We think that the need to know 
should be the guiding principle but it should be 
applied flexibly. The withholding of information on a 
technicality might create a spurious air of secrecy 
which could be counter productive. For appropriate 
sites the carrying out of safety assessments and the 
drawing up of emergency plans will effectively define 
the areas near the installation which might be 
affected. In our view this broadly defines the members 
of the public who should be told. 

26 Next, who should.be responsible for generating 
and passing on the necessary information? In the first 
instance the information must originate from the 
manufacturer but there is no overriding reason why he 
should also disseminate it. As a Committee we are 
inclined toward leaving this latter function to local 
authorities, chiefly because they will be close to those 
concerned as they are the public’s representatives in 
local matters. But we do not know how this would be 
done or whether this would place significant extra 
burdens on some authorities and we have not thought 
it necessary to make specific enquiries. The alternative 
is that this duty should also be placed on the 
manufacturer. We note that the HSC has indicated 
these alternatives in its Consultative Document on the 
Directive 6 and we think that the comments they 
receive are likely to be well informed. We therefore 
hesitate to make a firm recommendation. 

27 All these matters are in principle contained in the 
Directive which also defines the installations for which 
information should be given to the public. They are 
therefore to some extent a fait accompli. Individual 
states will, of course, decide how they implement it but 
we welcome this European initiative and the proposals 
for implementation which the HSC has published. 

28 We have however considered whether the 
arrangements required under the Directive should 
extend to other sites identified by the NIHHS 
Regulations. We think it would be unreal to suggest an 
across the board application to all such sites. While an 
incident in any of them might well involve one or 
more of the emergency services, the public’s 
involvement may be negligible. We therefore think that 
the information requirement of the Directive should be 
applied to Notifiable Installations only when the 
authority charged with implementing the Directive (the 
HSE) thinks it appropriate to do so. 

29 We believe that there should be informed debate 
about the hazards. This may require the dissemination 
of information beyond the needs of dealing with an 
emergency and something more than the 
implementation of the Directive. 

30 At the present time we believe the public is given 
information about sites and their hazards on an 
inconsistent basis. Some operators make considerable 
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efforts to establish a good relationship with their 
neighbours through booklets, meetings and open days. 
Other operators are less willing to give information in 
case security or commercial confidentiality is 
threatened and others have regard for the fears and 
suspicions that could be generated amongst members 
of the public by disclosure about processes and their 
potential hazards. There is also the danger of 
information reaching subversive organisations. 

31 The fact that some of the most successful 
operators in this industry are the most forthcoming 
with information suggests that the fears of the others 
may be exaggerated. Nevertheless we appreciate that 
they are real and would not wish to dismiss them. 
Commercial confidentiality may be a matter of vital 
importance to some companies and we acknowledge 
their need to safeguard their information, 

32 When it comes to the question of causing 
unnecessary alarm, a fear which some operators have 
expressed, we are less readily convinced. We believe, 
on balance, that information presented in a 
straightforward and above all objective and factual 
way without too much reassuring comment is likely to 
be readily acceptable and more likely to reduce rather 
than increase anxiety. 

33 While we are agreed that there is need for the 
dissemination of some information which goes beyond 
that required by the Directive if our wish to stimulate 
informed debate is to have any meaning, we are only 
too aware how easy it is to pronounce on general 
principles without indicating how they are to be 
applied. Indeed when it comes to detailed 
implementation we find ourselves on a less sure 
footing. The questions how much, to whom, by whom 
and for which installations, are crucial to the whole 
problem but evoke no easy answers. It may be that the 
wide differences between one installation and another, 
especially the essentially local factors, mean that no 
single prescriptive solution is a practical possibility. 
This lends weight to our view that the solution must 
emerge locally, perhaps from a local liaison committee. 
Such arrangements work well, we understand, in the 
nuclear industry and despite the intrinsic differences 
are worthy of consideration for the hazardous 
industries with which we have been concerned. 

34 We are aware that Section 3 sub section 2 of the 
HSW Act gives power to make regulations on this 
very matter but the fact that in a decade the HSC has 
not seen lit to recommend its implementation to the 
Secretary ol State suggests that appreciation of the 
difficulties is not confined to members of this 
Committee. Our terms of reference also create 
difficulties. While we strongly urge that the industries 
with which we have been concerned should seek to 
extend and strengthen the voluntary arrangements 
already in existence, perhaps encouraged by their 
respective trade organisations, we are hesitant to 
suggest that a statutory obligation should be placed 
upon any one group of employers before the wider 
implications have been considered. Many industries 
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with risks to the public other than the ones pertinent 
to our considerations are involved; nuclear energy is a 
specific example which may well present difficulties of 
which we are unaware. We think however that this is a 
matter of considerable importance and that the HSC 
should give urgent consideration to the problems 
involved with the implementation of S.3(2) of the 
HSW Act to see whether there are requirements which 
should be applicable to all industry. A universal 
statutory obligation would do much to avoid 
emotional reactions which might result if a single 
industry were singled out for special treatment. 

35 We summarise our discussion by recommending 
the following. 

(a) Unless responses to the HSC Consultative 

Document suggest otherwise, local authorities 
and local industry should devise systems to 
provide information to those members of the 
public likely to be affected by major accidents, in 



accordance with the requirements of the 
Directive. 

(b) The information requirement of the Directive 
should be applied to notifiable installations when 
HSE think it appropriate to do so. 

(c) Local liaison committees should be set up for 
notifiable installations, where appropriate, to 
bring together the public, industry, the emergency 
services and the HSE. 

(d) Voluntary arrangements for the supply of 
information to the public which go beyond what 
is needed for emergencies under the Directive 
should be extended and encouraged by trade 
associations. 

(e) The HSC should re-examine its powers under the 
HSW Act and consider whether regulations are 
required to secure the provision of specific 
information to designated recipients. 
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The control of major hazards 



3 Recognition and assessment 



36 In any system of control for major hazards, the 
first step is to establish suitable criteria to recognise 
those installations which present the greatest potential 
threat to safety. In our previous reports we considered 
ways in which these criteria might be chosen and 
included proposals based on a list of substances and 
their threshold quantities. The threshold quantities 
were in two parts; at the lower level an installation 
would be notified to HSE, and at the higher level (ten 
times that for notification) a hazard survey would be 
carried out. This procedure, though far from ideal, 
took account of the limited technical expertise 
available within industry to carry out these hazard 
surveys and within HSE to examine them. 

37 It is pleasing to record that these proposals with a 
few amendments have now been adopted in principle, 
firstly in the NIHHS Regulations and secondly in the 
Directive (see Appendix 3) which deals primarily with 
installations which hold substances in quantities which 
will require a hazard survey. While the Directive 
appears to derive from the views we developed on 
recognition of major hazards, we still consider there 
are fundamental problems concerning recognition and 
assessment of major hazards. The main points include: 

(a) how to equate different types of hazards; 

(b) how major hazards might affect the environment; 

(c) the relative danger of storage of a substance as 
against its use in a process, and 

(d) assessment of hazards and risks. 

38 There are many difficulties and uncertainties in 
establishing the equivalence of different hazards. One 
approach is to examine the information available from 
past major accidents. However, for some substances 
this information is lacking or incomplete and 
judgement must be exercised to consider the likelihood 
and consequences of accidents when deriving threshold 
quantities for these substances. Other approaches are 
more theoretical and have, for example, been based on 
estimates of the amount of a substance which will 
damage a defined area or cause an arbitrary number 
of casualties. 

39 For certain classes of substance, e.g. those with 
flammable, explosive or highly reactive properties, 
historical experience can be backed up by calculating 
the likely physical consequences of an incident. The 
energy produced by the combustion of a flammable 
material or the decomposition of an unstable 
substance can be compared with the energy produced 
by the decomposition of an explosive. Different 
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quantities of substances which are involved in 
explosions are also subject to scaling laws. There are 
no similar methods for estimating the effects of toxic 
substances, however, since the physiological effects of 
these substances are almost as varied as the chemicals 
which may be released. Thus difficult problems arise in 
comparing the major hazard potential of one toxic 
substance with another and then establishing an 
equivalence of hazard with substances in other classes. 

40 The Directive effectively divides toxic substances 
into two groups. The first group contains toxic 
substances, including liquefied gases and liquids of 
high volatility, which are handled in bulk quantities. 

The second group, which contains substances with 
highly toxic properties, includes solids and liquids of 
low volatility. We note that the threshold -levels which 
have been assigned by the Directive to the first group 
are broadly in line with the proposals which we made 
in our Second Report. On the other hand many of the 
threshold levels which are assigned to the highly toxic 
substances are as low as 1 kg. When this level is 
compared with the 50 tonnes assigned to chlorine it 
suggests that these substances are regarded as being 
50 000 times as dangerous as the latter even though 
they may possess very low dispersive energy. 

41 We agree that dioxin, because of its highly 
unusual properties, should be controlled at this level 
but it is our view that few other substances in Annex 
III of the Directive display a similar combination of 
toxicity and persistence. We note also that some of the 
substances listed are carcinogens of low acute toxicity 
the harmful effects of which require months or even 
ye^rs of exposure. We have not considerecf such 
substances in the past as constituting major hazards 
and see no logical way of including them in the 
category of major accident hazards. Insofar as the UK 
is concerned we consider that the existing means of 
regulation under the HSW Act are adequate, and even 
to be preferred, for dealing with dangerous 
carcinogens. 

42 When the Directive is reviewed we would 
recommend strongly that a more practical approach 
should be adopted. We would like to stress that the 
threshold quantities for most of these highly toxic 
substances are far too severe 7-8 . A matter of great 
importance however is that there are no clear 
guidelines to assess equivalence of hazard for these 
and other toxic substances and, at our instigation, 

HSE is sponsoring research on this topic. The research 
will be aimed at the development of two sets of criteria 
which ought in combination to provide clear 



Printed image digitised by the University of Southampton Library Digitisation Unit 



conclusions from which hazard levels can be 
categorised. 

(a) The first set of criteria should set out the factors 
from which an assessment of intrinsic toxic 
properties can be made. The original work will 
be concerned with lethal effects but this will be 
extended, at a later stage, to include an 
examination of non-lethal effects. 

(b) In the second the exposure characteristics of the 
substance will be assessed taking into account 
such factors as volatility, dispersion and 
persistence. 

Environmental major hazards 

43 Under the terms of our original remit we were 
asked to identify installations presenting a serious 
threat to employees, the public, or to the environment. 
We have concentrated mainly on effects on man, but 
the provisions of the Directive specifically draw 
attention to the protection of the environment from 
the effects of major industrial accidents. Major hazard 
accidents are sudden, acute events while serious 
accidents to the environment are generally the result of 
prolonged releases of perhaps only small amounts of 
toxic material causing long term damage. Rapid 
releases of large amounts of toxic material do not 
necessarily cause acute or long term environmental 
effects and we found it difficult to define precisely an 
environmental major hazard in a way which would 
achieve general acceptance. 

44 The problem could be approached from a purely 
financial aspect. For example, an environmental major 
hazard accident could be defined as an event costing 
more than about £10 million or some other arbitrary 
amount but it is seldom possible to place value on 
gross insult to the environment. 

45 We suggest that an environmental major hazard 
accident is most likely to occur when sudden emission 
of material causes long term or widespread damage to 
cash crops, farm animals, natural amenities (wild life) 
or contamination to land or water. The extent of the 
damage will depend on the characteristics of the 
material released, including its toxicity, persistence and 
ability to disperse. 

46 Substances expected to be most readily dispersed 
on loss of containment include gases held at pressure 
and fluids handled or processed at pressure above their 
atmospheric pressure boiling points. However as 
regards persistence, which in this context may be 
paramount, involatile liquids or solids may be of 
greater importance, but they would require an external 
agent for their dispersion. 

47 In the absence of suitable bunding, liquid 
materials can be dispersed by simple loss of 
containment, especially if a water course is reached. 
Wind, explosion, or fire will disperse particulate 
materials. Severe fires can have several effects. The 
high temperatures produced cause convection currents 



capable of lifting solid and liquid particulates to 
considerable heights and can also cause chemical 
changes in the materials involved, resulting in 
modification of their environmental toxicity. 
Furthermore the large quantities of water often used 
to fight such fires can by drainage introduce toxic 
materials into water courses (see Appendix 4). 

48 Having considered the methods of dispersal set 
out above, we think that most, if not all, accidents 
affecting the environment will also affect man, and 
therefore we believe that measures taken to protect 
man will for the most part also protect the 
environment. In the few possible circumstances where 
this might not be true we think the evidence available 
is not sufficiently reliable for us to make further 
recommendations. We think the subject should receive 
further attention some time in the future. 

Storage and process 

49 We have based our criteria for major hazard 
installations on the inventory of hazardous substances, 
taking into account the physical properties of the 
substance and the type of hazard it presents. We have 
not differentiated between materials used in process 
and those held in storage. We noted that in discussions 
of hazards in the oil and chemical industries it is 
sometimes suggested that the risk from materials in 
storage is less than that from materials in process. The 
historical record appears to indicate that storage 
facilities account for an appreciable proportion of the 
accidents causing multiple deaths, say five or more. 

We adhere therefore to our original view that there is 
at present no case for distinguishing between materials 
in process and those in storage. 

50 The Directive draws a distinction between 
isolated storage and other storage and specifies for 
the former larger threshold quantities, implying that 
the risks are less for such storage. Certainly isolated 
storage is by definition less at risk from process 
interactions, but on the other hand it is often managed 
by a company which is not in the mainstream of the 
oil or chemical industries and which is likely to be less 
familiar with the techniques of major hazard control. 
Again, therefore, we think that the case for a 
distinction has not as yet been made. 

Assessment and quantification 

51 Having identified a potential hazard it is then 
necessary to assess its seriousness and decide what 
should be done about it. This involves forming a 
judgement as to how real the danger is and the need to 
be able to do this has led to the development of 
formal assessment techniques. The expression ‘hazard 
assessment’ is modem jargon but civilised man has 
always striven to quantify the world about him in 
order to improve his understanding of it and to make 
use of his environment. Hazards and risks have been 
subjected to more detailed analysis in recent years but 
the resulting quantification should be seen in context 
as a means to an end and not an end in itself. 
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52 In today’s world, technology is becoming 
increasingly safe, and will continue to improve not 
only as the lessons of the past are applied to new 
ventures but as improved techniques are applied to 
assessing the risk of failure of any design and the 
consequent safety factors which must be built into the 
completed enterprise. The search for engineering 
reliability is as old as technology itself. In the past 
boilers exploded, bridges collapsed and ships sank. 

Each generation tried to learn from the mistakes of the 
past and to make new designs safer. This often led to 
crude increases in the strength of components; less 
frequently was there scientific appraisal of the 
underlying causes of failure. When we recommended 
in our 1979 Report that a major hazard plant should 
be the subject of hazard assessment we were doing no 
more than following an established and commonsense 
approach but with the assistance of more numerous 
and sophisticated techniques than formerly. 

53 Today there is increasing emphasis on the 
assessment of hazards and risk in quantitative terms. 
This may be limited to the estimation of the frequency 
of loss of containment, or it may go on to evaluate the 
physical consequences and in turn the dangers to 
employees or to the public. As far as frequency of a 
major incident occurring is concerned the estimates 
may well be fairly straightforward and can be derived 
from fault trees and the probability data for 
component failures. The depth of an analysis will 
depend to a large extent on the assessor’s view of the 
accuracy of his data and the purpose of the 
assessment. In this respect his judgement will vary 
according to whether he is seeking to increase plant 
reliability, to satisfy a public inquiry or to meet 
regulatory requirements, any one of which may be the 
most demanding, depending on the circumstances. 

54 At some stage in the evolution of the chemical 
industry it was recognised that its particularly 
hazardous processes should be fitted with automatic 
shutdown systems. This in turn led to the use of 
disciplined techniques such as fault tree analysis to 
show the fault pathways qualitatively and to develop 
suitable instrument configurations. The fault trees were 
then used quantitatively to assess the frequency of 
system failures leading to loss of containment or other 
major accidents. This led to a need to devise a risk 
criterion against which to assess the cost effectiveness 
of proposed safety alternatives. One such criterion was 
the fatal accident rate for employees. 

55 This early work was followed by a rapid increase 
in the application of the techniques of reliability 
engineering generally, to all kinds of engineering 
problems within the chemical industry, including those 
of plant availability and maintenance as well as of 
safety. Information and experience in this field has 
been fed back into the hazard assessment which is now 
an established part of engineering decision making 
when hazardous substances are involved. It assists in 
identifying the significant hazards, in choosing cost 
effective countermeasures, and in bringing out the 



underlying assumptions and the conditions which must 
be met if the hazard is to be properly controlled. 

56 Hazard assessment involves the consideration of a 
variety of potential accident sequences and the 
estimation of their frequency and consequences. The 
consequences may be expressed in various ways. A 
common form of presentation is to show a contour 
giving the risk of a defined level of physical effect on a 
map of the site and its environs. The analysis may be 
extended to provide an estimate of deaths and injuries 
or damage to property and thus of individual and 
societal risks. Great care is needed if this is done 
however, because the assumptions made are 
particularly critical and also because the models 
available to translate physical effects into fatalities etc. 
are subject to particular uncertainty. Frequently it is 
sufficient to make an order of magnitude estimate of 
the consequences so as to ensure some degree of 
balance in the effort employed to reduce the risk. 
Examples of these different types of presentation are 
given in the Rijnmond 9 , Canvey 10 , and St Fergus-Moss 
Morran Reports 11 . 

57 In general greater benefit is derived from the 
quantitative assessment of events leading up to loss of 
containment than from that of the subsequent events. 
There are a number of reasons for this, some 
fundamental, others perhaps less so. One is that 
management is able to exert considerable influence on 
the events prior to release but little on those thereafter. 
Another is that the degree of uncertainty in the 
estimate increases rapidly as the chain of events 
lengthens. Yet another is that the criteria for evaluation 
become increasingly subjective the further down the 
chain the assessment is taken. 

58 Whilst we generally recommend the use of 
quantitative techniques, we appreciate that they may 
pose difficult problems. The historical data on which 
estimates of frequencies, or probabilities, are generally 
based may be limited or open to doubt. If synthetic 
methods such as fault trees are used, there are the 
additional difficulties of identifying all the failure 
modes and of handling features such as common cause 
failure and human error. The models which are used 
to estimate the consequences, whether in terms of 
physical effects or of harm to people, are subject to 
uncertainty in varying degrees. There is also the crucial 
matter of the assumptions which are made. In hazard 
assessment there is a danger of making simplifying 
assumptions which lead to extreme and unrealistic 
results. Dangerous situations may be underestimated, 
but perhaps more frequently worst case assumptions 
are made which lead to predictions which are 
excessively pessimistic. A limit case approach has its 
uses, but in general a realistic assessment is preferable. 

59 It is widely held that the value of a quantitative 
assessment is not simply the calculation of a set of risk 
figures which meet some arbitrary criteria. Of prime 
importance is the greater understanding which is 
gained in the course of the work. This, in turn, leads 
to improvements being made. We have much 
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sympathy with this view. The assessment is not just a 
numbers game; nevertheless, we think that the risk 
estimates obtained cannot simply be disregarded. They 
should be evaluated in some way and the evaluation 
should be one of the factors considered in making the 
decision. At the same time when considering the 
application of any criterion it is necessary to bear in 
mind that the discipline of quantitative assessment is 
still developing rapidly. In our view, therefore, it is 
necessary to proceed with caution in the use of risk 
criteria to evaluate current assessments since there is 
still a considerable degree of uncertainty in these. We 
have outlined some principles on which criteria may be 
based in Section 2. 

60 We acknowledge that there is currently a lively 
debate among engineers on quantitative assessment 
and in particular on its role in the public domain and 
in regulation. We think, however, that it would be a 
pity if disagreement over this quite limited area were 
to hinder the development and application of this most 
useful tool for the control of hazards. 

61 Quantitative analyses require considerable 
resources of skilled manpower. We believe, however, 
that as the discipline matures many aspects will 
become more routine. It is not, of course, desirable 
that the whole analysis becomes routine, since a 
principal objective is to increase understanding of the 
plant, to identify hazards and to effect improvement. 



Nevertheless, in due course a larger quantitative input 
will be possible with greater economy of resources. 

62 One use of quantitative assessments on which we 
specifically wish to comment is with regard to 
statutory control. In both our earlier reports we 
expressly recommended that persons in control of 
hazardous installations should demonstrate to the HSE 
that the hazards have been identified and all 
reasonably practicable measures taken for their 
control. In particular it was always anticipated that the 
hazard surveys which are recommended would in part 
be based upon some form of quantitative assessment. 
We still hold this view. 

63 In order to facilitate this process we believe that 
the HSE should develop and make known the 
guidelines of what is good current practice. We also 
think that, wherever possible, the HSE should release 
the results of case studies as they did for the St Fergus 
to Moss Morran pipelines and Canvey. 

64 Finally we re-emphasise that the use of 
quantitative techniques is only one useful element in 
the overall system of control and only one input to be 
considered in decision making on major hazard plants. 
The main benefit in estimating risk lies in the 
achievement of detailed understanding of the 
engineered system and the implications of various 
options for technical measures and for siting. 
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The control of major hazards 



4 Avoidance 



65 If it has been established that a major hazard 
exists, the next step is to attempt to eliminate it or to 
reduce the frequency or probability of its occurrence. 
We attach the highest priority to the avoidance of 
accidents. In this section we consider three approaches 
to this objective: 

inherently safer design, 

high reliability plant and 

learning from warnings. 

Inherently safer design 

66 An important lesson drawn by engineers from the 
Flixborough disaster of 1974 12 was that a hazard 
potential may be limited by minimising the inventory 
of hazardous materials. However, limitation of 
inventory is but a particular example of the general 
principle of designing a plant or process so that it is 
inherently safer. This approach, to try to eliminate the 
hazard at source in a cost effective way, may in some 
cases require new technology but can often be 
achieved using established methods. 

67 Limitation of inventory may be achieved in 
various ways. One of the most important is to improve 
the design of the chemical reaction stage. A notable 
instance is the development of the nitroglycerine 
process, where the reaction is now carried out in a 
nozzle rather than a batch vessel with consequent 
reduction of inventory from about one tonne to a few 
kilograms. Better reactor design may also lead to 
reduction of inventory in the ‘downstream’ processing 
units. Limitation of inventory can be achieved also in 
other plant units by better engineering. Some very 
large reductions of inventory in distillation columns 
have been described. Other areas where inventory may 
be reduced include holdup vessels and pipe runs. 

68 We consider it should be a specific design 
objective for a major hazard plant to make it 
inherently safer. This is the classic route to ultimate 
safety. It is the direction in which the designer should 
always aim. The evidence of recent years is that if a 
company makes inherently safer design an explicit 
objective and there is a real effort to achieve it, 
designers are able to respond to the challenge and to 
effect improvements which are sometimes quite 
dramatic. 

69 Substitution of a more hazardous by a less 
hazardous process route or material is perhaps the 
most fundamental approach to inherently safer design. 
An illustration is the substitution of water for kerosene 
as the coolant in the process for the oxidation of 



ethylene. It has been suggested that heat transfer 
media in general offer considerable scope for the use 
of substitutes. 

70 The principle of inherently safer design may be 
applied to other aspects of the design of items of 
plant. An example is the avoidance of large branches 
on vessels through which hazardous materials can 
escape and flash off. Another is the design of plant to 
withstand full explosion pressure as a means of 
avoiding complex pressure relief systems. Frequently 
plants are rendered less safe by the introduction of 
complexity. Important causes of complexity include 
aiming at an excessive degree of equipment flexibility 
and making ad hoc modifications which in turn 
require further modifications so that escalation occurs. 

71 The above examples by no means exhaust the 
contribution of inherently safer design, but we think 
they are sufficient to demonstrate its importance. 

High reliability plant 

72 Having reduced the scale of the hazard, it is then 
necessary to complement this by reducing the 
frequency of realisation of the hazard. This is, in 
effect, improving the reliability of plant by both 
technical and managerial means. 

73 On the technical side advances continue to be 
made in many areas which are relevant to plant 
reliability. 13 They include: 

(a) The production and selection of construction 
materials which are most suitable for the 
containment of hazardous substances. 
Improvements lie in the resistance of the 
materials to corrosion, to mechanical erosion, to 
deterioration brought about by mechanical or 
thermal cyclic loading and to propagation of 
faults in the metallurgical structure. 

(b) The design of vessels and pipework to minimise 
the effect of these sources of deterioration, to 
reduce stress concentration and to facilitate 
inspection after construction and in service. 

(c) Techniques of non-destructive testing of 
completed vessels and pipelines and supporting 
structures for use on completion of construction 
and throughout the service life. 

(d) Techniques of condition monitoring for the 
continuous observation of pressurised vessels and 
pipelines and of rotating machinery so that an 
early warning of actual deterioration is 
obtained. 14 
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(e) Techniques of fracture mechanics which assist in 
avoiding catastrophic failure. 

(f) The instrumentation and control of the plant, a 
principal purpose of which is to prevent 
deviations from the design operating conditions 
and to detect and rectify those which do occur. 

The effectiveness of such systems has been greatly 
enhanced by the advent of computer control. 

74 The monitoring techniques described highlight the 
general problem of unrevealed failure which occurs 
both in plant vessels and equipment, and in 
instrumentation. In some cases the device is an active 
one so that failure is immediately obvious because it is 
no longer performing its function; but in others the 
device is passive so that failure tends to remain 
undiscovered. Typically such devices are used for 
protection. Often they are very simple items such as a 
tank vent. If there is no system of inspection and 
repair, the probability that the device will perform 
satisfactorily when a demand is made on it at some 
future time tends to zero. A proper appreciation of 
unrevealed failure in all its aspects and ol the need tor 
inspection, is of prime importance on major hazard 
plants. 

75 Allowance should be made in the plant design tor 
human error in its operation. There appears to be a 
growing consensus both in engineering and in law that 
the engineer is not entitled to assume that there will be 
no such errors. We agree with this view. The design 
should seek both to reduce the frequency with which 
initial errors occur and to minimise the consequences 
of such errors by eliminating direct pathways from 
operator error to major accident. In particular, the 
design of control systems should take account ot the 
principles of ergonomics to minimise the possibility of 
human error. 

76 We note with approval the examples we have been 
told about in which managerial control is being 
improved by modern management techniques and 
methods of communication, together with the 
recognition of safety as an essential management 
function. Areas of management in which advances are 
being made include: 

(a) the direction of design through techniques ot 
hazard analysis whereby sources of hazard in 
proposed plant are systematically identified and 
assessed; 

(b) the control of materials of construction through 
quality assurance procedures; 

(c) the supervision of construction; 

(d) the inspection and testing of the completed 
construction and the conduct ot commissioning 
trials; 

(e) operation of the plant within the design limits 
aided by the instrumentation and controls 
provided; 

(f) the training of process operators, particularly in 
fault diagnosis and handling 15 ; 



(g) the detection of deviations from normal 
operation and of abnormal occurrences, their 
reporting, analysis and feedback; 

(h) the use of the condition monitoring facilities and 
inspection of techniques available; 

(j) the control of modifications to the plant or the 
process; 

(k) the systematic application of maintenance 
procedures, and 

(l) the application of the principles of ergonomics to 
the design of control rooms and control systems 
to avoid confusion such as that which occurred 
at Three Mile Island. 

77 Common to both the technical and managerial 
aspects of control is the need to have a system which 
ensures that adequate health and safety requirements 
are maintained at all times. It is not unusual for 
mistakes at one stage to cause accidents at another. 
There is for example evidence that errors in design or 
construction may be a more significant cause of 
serious incidents than has so far been appreciated. The 
concept of quality assurance in the broad sense has 
already been adopted in some industries to maintain 
the required standard through the stages of design, 
construction, commissioning and operation including 
inspection and maintenance. We would endorse this 
overall approach to aspects of health and safety. 

Learning from warnings 

78 Even after all reasonable steps have been taken to 
reduce hazards and risks there may well be several 
events during the operating life of a major hazard 
plant which, whilst not resulting in a major accident, 
could be regarded as potentially dangerous 16 . These 
precursors may be described in general as ‘warning 
events’ or in the most serious cases as ‘near misses’. 
There is much which can be learned from such events. 

It is essential that there should be an ‘in-house’ system 
for reporting and investigating them and for making 
sure that the lessons are learned and applied. 

79 The value of such warnings may well be enhanced 
by analysis of the hazard warning structure of the 
plant. Generally the occurrence of a major accident 
requires the malfunction of more than one preventive 
feature. The structure of a major accident is often 
analysed at the design stage using a fault tree which 
shows the combinations of events which must occur 
for the top event, i.e. ‘the accident’, to occur. A fault 
tree may be used qualitatively to determine the fault 
paths which can lead to the accident and quantitatively 
to estimate the frequency of the top event. A fault tree 
can be constructed in such a way as to make explicit 
the preventive features which must fail for the major 
accident to occur, thus constituting a ‘hazard warning 
tree’, which might be used to gain greater 
understanding of warning events. The hazard warning 
concept is still undeveloped but we believe it may have 
value at least used qualitatively as an additional tool 
in hazard control and recommend that industry and 
the HSE explore its potential. 
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80 As we have already said, absolute safety in any 
sphere of human endeavour is impossible and it would 
be imprudent not to take account of the possibility of 
a major accident, however remote. Where there is a 
potential for such an accident, mitigating measures can 
be taken to reduce the impact upon people outside the 
installation. Firstly, common sense suggests that it is 
wise, if possible, to keep major hazard plants away 
from centres of population; similarly, it is wise to 
avoid a substantial growth in population near an 
existing installation. Secondly, the effects of any major 
accidents which do occur can be lessened by putting 
into action previously prepared emergency plans. 

These should enable the companies, the local 
authorities and the emergency services to cooperate 
efficiently for the protection of the public. 

Separation distances 

81 The separation distance between a hazardous 
installation and the public is a planning decision in 
those cases where a planning permission is required, 
and as such is not exclusively a technical matter. 
Planning decisions are discussed in more detail in 
Section 6. Consideration is limited here to technical 
guidelines which can be developed to assist the 
planning authority to make such decisions. However, 
before considering technical guidelines, it should be 
clearly stated that, in practice, separation between 
hazard and public is not a perfect solution to the 
problem because it has a number of limitations and 
drawbacks. It affords no additional protection to the 
workforce, the environment or the plant, it is difficult 
to specify with any precision; it may be expensive to 
provide, and it may be a contentious issue between the 
company, the local authorities and the HSE. In 
particular for established hazardous installations the 
risks from a well-run plant would not usually justify 
imposing a separation distance at the expense of either 
reducing the activity at the plant or of removing 
nearby buildings. Nevertheless, the planning process 
should provide the controls to prevent such situations 
intensifying or worsening. 

82 Ideally, the separation should be such that the 
population would be unaffected whatever accident 
occurs. For hazardous installations, however, such a 
policy is not reasonably practicable. It seems 
reasonable to aim for a separation which gives almost 
complete protection for lesser and more probable 
accidents, and worthwhile protection for major but 
less probable accidents. 

83 A particularly difficult problem is posed by 
accidents involving drifting vapour clouds. 



Theoretically a large escape of toxic gas could produce 
lethal concentrations in places many miles from the 
point of release. To achieve a low level of risk, 
separation distances would have to be excessive and 
for this reason plant reliability must be exceptionally 
high. 

84 The separation of a hazard from a built-up area 
need not mean, however, that the intervening land is 
completely sterilised or available only for agricultural 
purposes. Depending on the degree of hazard, it may 
be possible for it to be allocated for other purposes 
involving low population densities, including some 
industrial developments. 

85 In 1972 the DoE and Scottish and Welsh Offices 
issued Circulars drawing the attention of local 
authorities to the existence of major hazard plants and 
giving a list of inventories for various substances 
which was a precursor of that given in our own 
proposals for notification 17 . The local planning 
authorities were invited to seek technical advice from 
HM Factory Inspectorate (later HSE) when 
considering the siting of new installations or 
developments near existing installations. Since then the 
HSE has dealt with numerous requests for advice from 
local planning authorities. 

86 The decision in any particular case depends not 
only on the plant itself but also, for nearby 
developments, on the nature of that development. This 
is because different developments involve people in 
greater or lesser numbers and for varying periods of 
time. Different activities also involve different people 
of varying degrees of vulnerability. A relatively active 
and disciplined factory work force for example could 
reasonably be expected to take cover or evacuate a 
danger area in an orderly fashion. It would not be 
reasonable to expect the same response from an old 
people’s home, an infant school or a crowd of 
shoppers at a supermarket. 

87 In spite of the difficulties noted above, we believe 
that the production and publication of guidelines for 
deciding the separation of major hazards from people 
would be of benefit to all parties involved and we 
understand that HSE are developing such advice for 
planning authorities. We therefore recommend that the 
HSE develop and publish their guidelines and include 
the technical considerations. In making this 
recommendation we expect that these guidelines will 
be interpreted and applied with some flexibility. We 
understand that in the meantime, the HSE will 
propose consultation distances, based on cautious 
assumptions, to provide a starting point for the 
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assessments required to determine specific separation 
distances for individual cases. 

Emergency planning 

88 Our main concern here is with off-site emergency 
planning. The Chemical Industries Association (CIA) 
has published a guide Recommended Procedures for 
Handling Major Emergencies 18 , which concentrates on 
guidance for action within the site. We consider this 
provides adequate guidance; our remaining concern is 
whether its recommendations are followed by plant 
operators, but this is of course a matter for HSE and 
CIA. 

89 The responsibility for off-site emergency planning 
lies with the local authorities. In an emergency it is the 
emergency services, i.e. police, fire brigade and 
ambulance services, who control the action along the 
lines of a coordinated plan to deal with such a 
situation. Industry should provide any necessary 
information and support to local authorities and the 
emergency services. 

90 Until recently there has been no specific legal 
requirement in the UK for emergency planning for 
major hazard plants, although it might be regarded as 
one of the measures which should be taken to 
safeguard the public under Section 3 of the HSW Act. 
However the Directive does contain a requirement for 
emergency planning and this will be reflected in the 
UK legislation implementing the Directive. 

91 The Directive requires operators of specitied 
installations to prepare an emergency plan for the site. 
These operators will also be required to pass 
information on to an appropriate competent authority 
to enable it to prepare an emergency plan tor action 
outside the establishment. Further, persons liable to be 
affected by a major accident in a specitied installation 
should be informed of “the safety measures and the 
correct behaviour to adopt in the event of an 
accident”. 

92 HSC issued a Consultative Document 6 in 1983 on 
the proposals to implement the Directive. The HSE 
will be the enforcing authority and local authorities 
are proposed as the competent authority to draw up 
the off-site emergency plans. We note that the 
proposed statutory requirements for emergency 
planning will only apply to installations specitied in 
the Directive and will not be extended down to 
‘notifiable’ installations (i.e. notifiable under The 
NIHHS Regulations) and we support this. 

93 In view of these forthcoming legislative changes 
both local authorities and industry need to review their 
approach to emergency planning, in particular in 
relation to the off-site aspects of an incident at a 
major hazard plant, which we leel may have been, in 
many cases, insufficiently appreciated. 

94 One of our working groups has held meetings 
with those involved in emergency planning trorn 
government, local authorities, emergency services and 
industry. It appears that the present level ot 



preparedness for an emergency arising from a major 
hazard installation varies very much from county to 
county. 

95 We consider there should be a statutory unified 
system of emergency planning with the responsibilities 
placed on the local authorities (at county level). They 
should plan for emergencies which could arise at 
major hazard plants, both process and storage 
installations. 

96 As far as industry is concerned, implementation of 
the Directive will create a statutory requirement for 
emergency planning for specified installations. We 
interpret this to mean that industry is responsible for 
on-site emergency planning and that the local 
authorities are responsible off-site. 

97 We consider that industry’s role in off-site aspects 
of an emergency should involve plant operators in 
providing information, advice and where appropriate 
supportive action, but not in executive action ott-site. 

We think that the emergency plans of individual 
companies should be properly coordinated among 
themselves where they are in close proximity and with 
that of the appropriate local authorities. To achieve 
this, it is essential that the plan be discussed and 
periodically rehearsed with the local authorities and 
the emergency services. 

98 We believe that industry should prepare 
appropriate models of major incidents and suggested 
emergency actions which can be used to develop 
broad-based advice on appropriate measures for local 
authorities and the emergency services. The form this 
advice takes and the way in which it is communicated 
are both important. A range of models covering 
incidents of escape and dispersion of flammable and 
toxic materials of graded severity should be 
considered, but the main effort should be concentrated 
on those which are serious but not excessively 
improbable. We consider that on the basis of these 
studies industry should offer information to local 
authorities and the emergency services. This 
information may need to incorporate some different 
courses of action for different situations, but at the 
same time it should avoid an excessive number of 
permutations of possible events and choices. 

99 In any emergency, control off-site is the 
responsibility of the police. A crucial decision which 
they have to take on the basis of among other things, 
industry’s information is whether to initiate 
evacuation. We urge that industry should provide, in 
advance, advice based on the studies described. 

100 We believe that there must be clearly defined 
responsibilities and that liaison personnel should be 
nominated by companies, from whom information 
should be available at all times (including a company’s 
silent hours). They should be able to interpret 
industry’s previously provided information in the 
particular circumstances of an incident occurring. 
Consideration should be given to nominating someone 
specifically to liaise with the emergency services and 
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media during an emergency, leaving those responsible 
for bringing an incident under control to get on with 
that job. However, if this type of arrangement is to 
work effectively then a good communications system is 
crucial to allow essential personnel to remain in 
contact during an emergency. 

101 We recommend that the CIA should be asked to 
publish an extension to its code mentioned in para BB 
covering industry’s role in emergency planning off-site. 
This could be in the form of a supplement to the 
existing code or a separate code. In our discussions 
with the CIA we pressed for the production of such a 
code and have indicated the general concepts on which 
we think it should be based. 

102 For local authorities, we recommend that there 
should be a statutory requirement for the preparation 
of emergency plans for major hazard plants which we 
think should logically be part of a unified system of 
emergency planning. 

103 The Home Office should consider the revision of 
the joint Circular ES7/1975 19 which gives guidance to 
local authorities on civil emergencies, to take account 
of these developments. We also think that 
consideration should be given to combining revision of 
this Circular as far as major hazard installations are 
concerned with proposals for the administrative 
arrangements necessary to implement the Directive’s 
off-site emergency planning requirements. 

104 We have had described to us a number of 
systems of emergency planning for industrial hazards. 
These include the Central Electricity Generating 
Board’s emergency plans for its nuclear power stations 
and the emergency planning arrangements on Teesside, 
Canvey, South Humberside and at Fawley. This and 



other evidence which we have heard indicates that 
there are in some areas well prepared, effective and 
tested emergency plans. However, there remain many 
authorities who do not have adequate plans and still 
more who do not adequately test the plans they have. 
As in so many of the other aspects which we have 
considered, we think that immense progress would be 
made if emergency planning in all areas could be 
brought up to the level of the best. 

105 We also suggest that the local authorities should 
consider taking the lead in the creation of local liaison 
committees which involve themselves, the emergency 
services and industry as well as the HSE. 

106 Usually major incidents arise from escapes of 
either flammable or toxic material. There is a variety 
of substances handled by industry where the 
appropriate responses, antidotes and treatments may 
well be specific to the particular substance. We wish to 
emphasise how important we believe it to be that the 
medical services be prepared to deal with the toxic 
hazards which exist in their area. We recommend that 
the Medical Division of HSE should be active in 
pursuing this objective. 

107 Thus although we have supported the view that 
the statutory requirements for emergency planning by 
industry should be limited to installations subject to 
the Directive’s implementing legislation, we consider 
that the emergency planning systems so created will in 
fact provide a framework for emergency planning for 
installations down to and below the notifiable level. 
We attach much importance to this. 

108 By the above means, it is hoped that a more 
uniform and better level of preparedness for 
emergency situations arising from hazardous 
installations can be achieved. 
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109 Control of the location of new developments is 
the responsibility of local planning authorities under 
the Town and Country Planning Act 1971 (TCP Act). 
Government circulars issued in 1972 17 advised local 
planning authorities to consult HM Factory Inspectorate 
(now HSE) on planning applications for all new major 
hazard installations and also on proposals for other 
development in the vicinity of existing installations. This 
was to try to ensure that local planning authorities would 
have the benefit of the HSE’s advice on safety aspects 
when considering planning applications both for the 
installations themselves and developments nearby. Since 
1972 these arrangements have been refined and also now 
apply to all installations notifiable under the NIHHS 
Regulations. This section reviews the situation.* 

110 Planning law is designed to control 
‘development’ and the overall use of buildings or land, 
but not specific activities which might take place as a 
part of that use. Thus, for example, once permission 
has been granted for a particular use which involves a 
hazardous substance, an increase in the quantity kept 
at the installation as part of that use will not attract 
further planning controls, unless the increase is 
accompanied by development of the land within the 
meaning of the TCP Act. This and other loopholes 
were identified in our Second Report and we made 
recommendations for changes to planning legislation. 
These matters are referred to in greater detail later in 
this section. 

111 Decisions where safety is involved often present a 
dilemma for planning authorities. In many cases the 
authorities have to weigh the advantages which the 
proposed development might bring against the 
disadvantage that more people might be at some risk. 
The decision is less difficult when this risk is very great 
or very small, but many cases fall between these 
extremes. In some cases the decision could mean 
refusing planning permission for a development which 
would have brought more jobs to the area in order to 
safeguard those already living in the area against a 
marginal increase in risk. It has been suggested that 
when safety is involved the planning decision should in 
effect be taken by the HSE on the grounds that 
planning authorities are not experts in the assessment 
of risk. We have rejected this in the past and continue 
to do so as we believe it is based on a 
misunderstanding of planning principles. When a 

* Throughout this Report all references are to the Acts and 
Statutory Instruments applicable in England and Wales. The 
relevant Scottish Acts and Statutory Instruments, while separate, are 
for practical purposes identical and the views expressed by us apply 
to Scotland as to England and Wales. 



planning application is being considered a balanced 
view should be taken of all aspects including social 
and economic factors and not just health and safety. 

Our view is that HSE ought to provide a clear 
assessment of the risks associated with the 
development and to ensure that plant standards are 
appropriate for those risks. The decision on whether 
or not to grant planning permission for an installation 
which meets health and safety criteria should however 
rest with the local planning authority who, on behalf 
of the local community, attempts to come to a 
balanced decision, having taken all the factors into 
consideration. In some cases where an installation is of 
wider regional or national significance, the final 
decision may be taken by the central government. 

112 Planning applications are decided on an 
individual basis but within the broad policy framework 
established by structure and local plans. When such 
plans were drawn up in the past, many local planning 
authorities had little information or advice about the 
special needs and problems brought about by 
hazardous installations. Consequently HSE could be 
obliged to advise against giving planning consent for 
general industrial development or against applications 
for residential development in areas which have been 
designated for these purposes because they would be 
too close to an existing hazardous installation. If local 
plans were prepared with such installations in mind, 
guidance to developers including industrial developers 
and the public would be considerably improved. With 
the notification procedures under the NIHHS 
Regulations local planning authorities will be able to 
revise local plans to take into account land use 
implications of such installations. 

113 The 1972 government circulars asked planning 
authorities to consult HMFI (now HSE) on 
applications for development in the vicinity of certain 
installations but there was no explanation of the term 
‘vicinity’. To be helpful HMFI suggested that it should 
be taken as meaning a zone of 2 km radius around an 
installation. Such a general definition was soon to be 
found unsatisfactory, especially within existing built-up 
areas, since HMFI had no comment to make on a 
large number of applications forwarded as part of the 
consultation process. The result was that some local 
planning authorities established their own consultation 
criteria and as a consequence inconsistencies arose. 
Experience has shown that consultation criteria should 
be as precise as is practicable in order to avoid 
unnecessary work for HSE and the authorities. New 
arrangements introduced in 1983 will greatly improve 
the understanding and cooperation of all involved. On 
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receiving a notification, HSE passes details to the 
planning authority, and at the same time suggests a 
consultation zone within which the planning authority 
is asked to refer certain applications to HSE for 
advice. The basis of that advice is referred to in 
Appendix 11. We understand that these arrangements 
will be explained in the forthcoming revision of the 
government circulars which will also describe the types 
of application in which HSE is particularly interested. 

1 14 We consider it essential that local planning 
authorities should fully understand the weight to be 
attached to the HSE advice, and that discussions 
should take place between all interested parties to 
identify and resolve any difficulties or problems. 

Legislative changes 

115 In our Second Report we considered whether 
planning legislation could provide an effective means 
of controlling a hazardous development. We outlined 
some weaknesses and made recommendations for 
changes. Our objective was to ensure that specific 
planning permission would always be required for a 
proposed notifiable installation whether entirely new 
or simply a change at an existing site. We recognise 
that this objective would not be met unless alterations 
were made in both the TCP Act and in subordinate 
legislation (the Town and Country Planning (Use 
Classes) Order 1972 and the Town and Country 
Planning General Development Order 1977). Ministers 
have prepared changes to subordinate legislation which 
are intended to come into force on 1 May 1984 but we 
understand that there is no immediate prospect of 
amending the Act itself. 

116 Failure to amend the definition of development 
in the TCP Act will mean that the creation of a 
notifiable installation will still not necessarily of itself 
require planning permission. In such circumstances 
permission will only be required where some external 
physical changes are proposed or there is a material 
change of use (in other words development). 
Amendment of the two Orders will not fully resolve 
the issue. 

117 It is not possible to estimate how many 
additional cases would be caught by the proposed 
changes, nor how many cases would still escape the 
need to obtain planning consent. There will 
undoubtedly be a number, some of which could be of 
significance, the most obvious category being the 
storage of hazardous materials in existing warehouses. 
Another category would be where there is an increase 
ot inventory of a hazardous substance being used in an 
existing factory building, e.g. a change from 15 to 30 
tonnes of LPG. The installation would become 



notifiable but planning permission would not be 
required unless there were a material change in the use 
of the land or there were to be external physical 
changes (i.e. development). 

118 We again urge that further consideration be 
given to the amendment of the TCP Act at the first 
possible opportunity to close the significant loophole 
in planning controls for notifiable installations. 

1 19 In our First Report we recommended that planning 
authorities should be required by statute to consult 
HSE on planning applications for both notifiable 
installations and proposals for development in their 
vicinity. The changes to subordinate legislation 
(referred to in para 115) will achieve this for new 
installations in England and Wales (Scotland has had 
this arrangement since 1981). For developments in the 
vicinity of hazardous installations we recommended 
statutory consultation also in the belief that it would 
be possible to devise arrangements sufficiently flexible 
to allow selectivity and ensure that unnecessary 
consultation would not take place. However, it has not 
proved possible to combine the statutory approach 
with the need for flexibility in the detailed operation of 
the consultation arrangements, and non-statutory 
arrangements have therefore been introduced. We 
recommend that their effectiveness should be kept 
under review. 

Compensation 

120 In our Second Report we outlined the 
circumstances in which local planning authorities 
might be liable to pay compensation to developers, 
and noted that in those circumstances it is local 
planning authorities alone who have to bear the 
financial burden for decisions taken in the interests of 
public safety. We recommended then that the 
Secretary of State for the Environment review the 
extent of his discretionary powers to make payments 
to local authorities to meet compensation liabilities. 

121 We feel obliged to return to the matter of 
compensation as we consider it could have 
considerable implications for safety. DoE’s present 
proposals for planning changes could create a right to 
compensation in those cases in which a developer’s 
existing planning rights are withdrawn. We are of the 
opinion that these financial considerations might in 
some circumstances deter local planning authorities 
from making decisions in the best interests of the 
safety of the community. We therefore recommend 
that the Secretary of State for the Environment give 
further consideration to present compensation 
arrangements. 
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122 The educational requirements for engineers 
working in the major hazard area are essentially the 
same as those in other areas, except that if the needs 
are not properly met, the consequences may be much 
more serious. 

123 The right philosophical approach is for senior 
management to insist that staff receive adequate 
training and adopt a reasonable approach to the safe 
design and operation of plant in which hazardous 
materials are processed, A systematic approach 
towards loss prevention has developed considerably in 
the last decade or so and it is only during this period 
that the subject has received satisfactory treatment in 
undergraduate, postgraduate and post-experience 
courses. As a result senior staff, who fulfil key roles in 
the area, may not have had the advantages of these 
educational opportunities and it is therefore important 
that suitable courses should be available to supplement 
their experience. It has always been the view of 

the committee that an enlightened attitude towards 
safety in senior management is the key to establishing 
the appropriate climate throughout the whole 
organisation. 

124 It is important that students be introduced to the 
concept of inherently safer design and that they realise 
that safety in plant operation must be considered right 
at the start of the design study. Process safety must be 
taught in a rigorous, stimulating way by staff of 
appropriate experience, Departments which initially do 
not have this expertise may need to use the services of 
experts from other universities, industry and consulting 
firms. By virtue of the nature of the processes which 
give rise to major hazards, it is the chemical engineer 
who often fills the position of responsible person in 
the design or operation of plant. It is pleasing 
therefore to note that there has been a progressive 
strengthening of process safety in the essential core 
material, A Scheme for a Degree Course in Chemical 
Engineering, produced by the Institution of Chemical 
Engineers. All university and polytechnic courses 
which give exemption from the examination 
requirements for corporate membership of the 
Institution, and hence for Chartered Engineer status, 
must cover the syllabus, but the extent to which this is 
done by formal lectures or as part of the design 
project is left to individual universities. 

125 Universities have an important function in 
postgraduate training and research and it is apparent 



that an increasing number of Departments of 
Chemical Engineering are working, frequently in 
collaboration with industry, in areas related to process 
safety including reliability engineering, modelling and 
assessment of hazards. Two specialist departments — 
Fire Safety Engineering at Edinburgh and 
Occupational Health and Safety at Aston — are doing 
valuable work and we consider it important that their 
futures should be secure. Courses are frequently 
organised on a modular basis so that individual 
modules may be taken by engineers from industry. 

126 On leaving university, students should have an 
understanding of basic principles and techniques 
relating to safety and an attitude of mind which makes 
them receptive to the need for further training. The 
Institution of Chemical Engineers has assisted in this 
by the stimulation and coordination of courses in 
which universities, industry and consultants have all 
played important parts, and by the production of its 
Loss Prevention Bulletin. It is regrettable that a fall-off 
in attendance at these courses has occurred recently, 
no doubt partly due to a reluctance of industry to 
release key personnel for other than short courses, 
There is a similar situation with other post-experience 
safety courses. 

127 We think it is shortsighted policy today to ignore 
these opportunities for further training. Wc consider 
that this situation is of concern since a lack of 
appropriate safety training in the short term will 
contribute problems in the future. We therefore 
recommend that industry should be willing to release 
staff at all appropriate grades up to senior level to 
attend courses specifically aimed at improving their 
safety awareness and performance. We further 
recommend that there should be more short courses 
available and that the longer courses should have a 
modular structure. A strong plea is made for 
government finance to be made available to cover the 
cost of such courses. 

128 Engineers, other than chemical engineers, and 
scientists, including chemists, physicists and biologists, 
may be the key responsible persons for some processes 
and plants, in which case they will require a similar 
understanding of safety principles. It is recommended 
that other professional institutions, where appropriate, 
should follow the example set by the Institution of 
Chemical Engineers. 
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129 We described in the previous section the 
important role of education in ensuring awareness of 
current standards in major hazard control. We now 
consider the role of research to help improve 
standards. We drew attention in our Second Report to 
the importance we attach to research, and in this 
section and the appendices we discuss the subject in 
greater detail. From an improved understanding of the 
mechanisms of plant failure, better standards of plant 
design and control should result so that the risk of 
failure is reduced. While this must be the first 
objective in major hazards research, there is also a 
need to study the consequences of a large scale release 
of a flammable or toxic substance if for some reason 
there is a loss of plant integrity, and how these 
consequences can be mitigated. 

130 Considerable effort has been put into research 
over the past few years, both nationally and 
internationally, and we note particularly the valuable 
cooperation between researchers in this field. We 
consider it of great importance that organisations 
which are carrying out research relevant to major 
hazards maintain a liberal policy in relation to the 
publication of results and keep in close contact with 
other organisations working in their area of research 
to minimise overlap and make the most rapid overall 
progress. 

131 We have continued in our task of trying to 
identify areas where further work is required. To assist 
in this we have considered it important to visit 
organisations in the UK which are carrying out 
valuable research on major hazards. Thus we have had 
discussions with Shell Research, British Gas, Imperial 
Chemical Industries, Department of Trade and 
Industry (Warren Springs .Laboratory) and HSE, and 
we have received much useful information about 
current work, and proposals for future research. In 
this section we look at the subject as a whole and in 
Appendices 5-10 and 12-14 specific areas of research 
are discussed in greater detail. It will be noted that 
some of these appendices have been prepared by HSE 
stall at our request. The HSE itself is a major 
contributor to research over a wide range of major 
hazard topics through its own research laboratories 
and through research contracted to other bodies, 
particularly the Safety and Reliability Directorate of 
the United Kingdom Atomic Energy Authority. Much 
of this work has also been published. 

132 We are concerned above all with loss of 
containment. While we recognise that ultimately any 
failure of a man-made system can be regarded, in a 
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sense, as a human failure, the immediate cause of such 
an event may arise from a failure of hardware or from 
direct human error. It is convenient therefore to review 
research on hardware and human reliability separately 
but we must recognise the importance of the inter- 
relationship between the two. The avoidance of loss of 
containment depends in large measure on plant 
reliability. This is too large and disparate a field for us 
to make detailed recommendations, but we have 
indicated, particularly in Section 4, some aspects which 
we think important. In particular, we wish to express 
support for research on major hazard plant design. 

133 Another important aspect of hazard control is 
the regular inspection of plant, especially the relief 
systems and controls. This inspection may take the 
form of a simple visual check, but condition 
monitoring is becoming a sophisticated tool of 
considerable value and further effort should be 
devoted to its development. There is clearly a need for 
further development of techniques for in-service 
monitoring of such effects as corrosion, erosion, 
fatigue, mechanical damage and incipient leakage in 
systems of containment. Ideally, these would be on- 
line and continuous but, for a start, there is room for 
progress in inspection techniques. Examples of 
progress to date are the ‘intelligent pig’ for pipelines 
and techniques tor acoustic monitoring now emerging 
for pipeline and vessels. 

134 While the role of man in the safety aspects of 
industrial systems is increasingly appreciated, we 
consider that research into human reliability, and its 
subsequent application, still tends to be fragmented 
and applied narrowly to specific tasks and industries. 
Any assessment of the behaviour of individuals at 
work is bound to be complex but if reliable 
quantitative techniques are to be established efforts 
must be directed towards establishing reasonable bases 
of fact and assumption. A paper on this subject is 
presented at Appendix 13 and we support the view 
that some mechanism should be set up in this country 
to review and give guidance on research in this field. 

135 Reliability improvement and reliability 
assessment are linked. We think there is need for work 
which establishes more clearly the dependability of 
fault tree assessments and the level of reliability which 
is feasible in plant design. These aspects are discussed 
in Appendix 12. 

136 If a failure of primary containment does occur 
the consequences of the release of a significant 
quantity of hazardous material depend on a number of 
complex factors, including the nature of the material, 
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the conditions under which it is held and the type of 
environment which surrounds the plant. Research has 
tended to fall into two parts; the evaluation of the 
source term, which defines the physical form of the 
emission as well as the rate of emission, and the 
examination of the consequences of the release. While 
such research usually has industrial storage and 
process in mind, its application to the trahsport of 
hazardous materials is also highly relevant. 

137 A short review of research on emission is given 
in Appendix 5 and there would appear to be two 
particular areas for future work. There is a need for 
better information on the behaviour of flashing jets 
and on atmospheric entrainment into them. There 
should be further study of the spread and evaporation 
of pools of cryogenic and non-cryogenic liquids on 
land and water. While these proposals are mainly 
concerned with a breach of primary containment, there 
is also a continuing need for research on the 
effectiveness of secondary containment, such as bunds, 
ducts or catchment pits, or buildings. 

138 Some of the major releases of hazardous material 
can lead to the formation of clouds which are heavier 
than air and a review of the present position on heavy 
gas dispersion is given in Appendix 6. Since our 
Second Report, a number of large-scale trials have 
been undertaken in order to simulate what might 
occur in current industrial operations. Such trials are 
very expensive and time-consuming. They involve 
expenditure of several millions of pounds, and much 
credit must be given to those who have recently 
funded and carried out valuable experimental work in 
the UK such as at Thorney Island and before that at 
Maplin Sands 20 . 

139 Because of the complex nature of the problem of 
dispersion, initial work has nearly always considered 
the simplest situation, a release of heavy gas over Hat, 
open and uniform terrain. Once the mechanisms of 
turbulence and dispersion under these conditions have 
been reasonably established, the next stage is the 
examination of the effects of obstructions and features 
such as ground slope. The second part of the Thorney 
Island trials has been concerned with the effect of 
structures such as walls and buildings. Another critical 
area for future research is establishing how a release of 
hazardous material is likely to occur and how it will 
form a gas cloud in close proximity to the point of 
escape. Such work is closely related to the research on 
emission which we have discussed earlier in this 
section. We have also referred to the enormous cost of 
large scale experimentation. We strongly support the 
view that every effort must be made to extract the 
maximum information from wind tunnels and any 
other cost-effective small scale experimentation. 

140 One of the serious consequences of the release of 
a large quantity of volatile flammable liquids or 
flammable gases is that subsequent ignition may lead 
to an unconfined, or partially confined vapour cloud 
explosion, the type of event which produced such 
disastrous effects at Flixborough. Research on this 



topic is discussed in Appendix 7 and we also draw 
attention to a recent paper by M J Pikaar 21 . It is only 
in the last few years that some of the difficulties in this 
area of research are being surmounted and there is 
now a prospect of being able to explain or predict the 
circumstances which can give rise to a vapour cloud 
explosion and what the effects are likely to be. Further 
research is important in this regard particularly to 
create understanding on how flames can be accelerated 
to the point where appreciable overpressures are 
generated, the simulation of non-spherical explosions, 
and the effect of blast on structures. 

141 Another possible consequence of the rapid 
release' of a large quantity of volatile flammable 
material is the phenomenon known as a fireball, which 
is described in Appendix 8. In this event ignition takes 
place near the source of the escape so that burning 
and mixing take place together. At present, estimates 
of the thermal effects are based on the results of small 
scale experimentation and empirical calculations and 
the technical and financial needs of large scale work to 
validate or improve these conclusions should be 
determined with a view to promoting a collaborative 
research programme. 

142 The effects of toxic substances are almost as 
varied as the toxic chemicals which might be released 
and we have discussed in Section 3 the problems 
associated with the recognition and the assessment of 
toxic hazards. There is a need for a better system of 
identifying the toxic substances which could have the 
potential under particular conditions of use to cause a 
major accident. We understand that there is research 
being undertaken in this area. 

143 The objective of all work on the control of major 
hazards, including research, is to reduce the number of 
human casualties by reducing the probability of a 
release occurring and by mitigating the consequences 
of any release. However, while methods for the 
calculation of physical phenomena improve, marly 
effects of these phenomena on people are still known 
only in very general terms. We have already referred 
to problems in estimating the effects of fires, 
explosions and the release of toxic substances on the 
surrounding population. We see this as the area where 
further research is needed so that a better idea may be 
obtained of the possible number of casualties arising 
from any particular incident scenario. 

144 Our review strongly highlights the need to obtain 
as much scientific information as possible from actual 
incidents when they occur. The data potentially 
available from large incidents gives rise to serious 
effects of a kind which in practice no experimental 
work could ever provide. We therefore, emphasise the 
need for satisfactory systems for the collection, storage 
and retrieval of data. Various types of information 
systems are required, recording data on equipment 
failure and repair, on human error and on accidents 
and incidents. Furthermore, any assumptions made in 
the interpretation of evidence need to be formally 
listed. The modern approach to such problems is to 
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create computer data bases which may be searched 
rapidly by associated information retrieval 
programmes and this is discussed in Appendix 14. 

145 We are also concerned that the present standards 
of reporting incidents vary almost as widely as the 
incidents themselves. We see a need for an improved 



system of classification of major incidents on 
hazardous installations. There is no doubt that an 
agreed standard of reporting incidents would greatly 
enhance the quality of the information which is 
available and this would be of great benefit both 
nationally and internationally 22 . This aspect is 
considered in more detail in Appendix 12. 
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The control of major hazards 



9 Conclusions and recommendations 



Transport 

146 We recommend that the major hazard aspects ol 
the transport of dangerous substances should be 
pursued (para 1 1 and Appendix 2). 

Living with risk 

147 We believe that the “reasonably practicable” 
approach embodied in the HSW Act is applicable to 
the control of major hazards and should continue to 
be followed (para 15). 

148 We believe that there are upper and lower limits 
between which risks and benefits need to be balanced 
but that there is less scope for setting a risk criterion 
than is sometimes acknowledged (paras 19 and 20). 

149 We believe that there is widespread support for 
the following propositions. 

(a) The risk from a hazardous installation to an 
individual employee or member of the public 
should not be significant when compared with 
other risks to which he is exposed in everyday 
life. 

(b) The risk from any hazardous installation should, 
whenever reasonably practicable, be reduced, 

(c) Where there is a risk from a hazardous 
installation, additional hazardous developments 
should not add significantly to the existing risk. 

(d) If the possible harm from an incident is high, the 
risk that the incident might actually happen 
should be made very low indeed (para 21). 

Information to the public 

150 We think that the information given to the 
public nearby should include: 

(a) the nature of the hazards which might affect 
them if control measures fail; 

(b) the emergency arrangements which have been 
made in advance, and 

(c) what they should do in a major incident (para 
23). 

151 We believe that there should be informed debate 
about major hazards and that there is need for the 
dissemination of some information which goes beyond 
that required by the Directive (paras 29 and 33). 

152 We recommend: 

(a) Unless responses to the HSC Consultative 

Document suggest otherwise, local authorities 



and local industry should devise systems to 
provide information to those members of the 
public likely to be affected by major accidents, in 
accordance with the requirements of the 
Directive. 

(b) The information requirement of the Directive 
should be applied to notifiable installations when 
HSE thinks it appropriate to do so. 

(c) Local liaison committees should be set up for 
notifiable installations, where appropriate, to 
bring together the public, industry, the emergency 
services and the HSE. 

(d) Voluntary arrangements for the supply of 
information to the public which go beyond what 
is needed for emergencies under the Directive 
should be extended and encouraged by trade 
associations. 

(e) The HSC should re-examine its powers under the 
HSW Act and consider whether regulations are 
required to secure the provision of specific 
information to designated recipients (para 35). 

Recognition and assessment 

153 We note that there are inconsistencies in the list 
of substances in Annex III of the Directive (paras 40 
and 41). 

154 When the Directive is reviewed we recommend 
strongly that a more practical approach should be 
adopted and stress that the threshold quantities for 
some highly toxic substances are far too severe. At our 
instigation, the HSE has sponsored research to develop 
guidelines to assess the equivalence of hazard for these 
and other toxic substances (para 42). 

155 We believe that most, if not all, accidents 
affecting the environment will also affect man, and 
therefore we believe that measures taken to protect 
man will for the most part protect the environment. 

We think the subject should receive further attention 
some time in the future (para 48). 

156 We adhere to our original view that there is at 
present no case for distinguishing between materials in 
process and those in storage (paras 49 and 50). 

157 We still hold the view that the hazard surveys 
we recommended in our previous reports should in 
part be based upon some form of quantitative 
assessment. We note that the discipline of quantitative 
assessment is still developing rapidly and is only one 
useful element in the overall system of control and 
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only one input to be considered in the decision making 
on major hazard plants (paras 59 and 64). 

158 We believe that the HSE should develop and 
make known the guidelines of what is good current 
practice in quantitative assessment (para 63). 

Avoidance 

159 We attach the highest priority to the avoidance 
of accidents by inherently safer design, high reliability 
plant and learning from warnings (para 65). 

160 We consider a specific design objective for the 
major hazard plant should be to make it inherently 
safer (para 68). 

161 We endorse the full use of the technical and 
managerial techniques available to ensure high plant 
reliability; measures should be taken to combat 
unrevealed failure and human error (pargs 74, 75 and 
77). 

162 We believe it is essential that there should be an 
‘in-house’ system fqr reporting and investigating 
warning events and for making sure that the lessons 
are learned and applied (para 78). 

163 We recommend that industry and the HSE 
should explore the potential of the hazard warning 
concept (para 79). 

Mitigation 

164 We believe it would be imprudent not to take 
account of the possibility of a major accident, however 
remote; the main mitigating measures are to keep 
major hazard plants away from centres of population 
and to plan for emergencies (para 80). 

165 We believe it is reasonable to aim for a 
separation (between plant and the public) which gives 
almost complete protection for lesser and more 
probable accidents and worthwhile protection for 
major but less probable accidents (para 82). 

166 We recommend that the HSE develop and 
publish their guidelines and the technical 
considerations for separation distances (para 87). 

167 We believe that the CIA code provides adequate 
guidance for on-site emergency plans (para 88). 

168 We recommend there should be a statutory 
unified system of (off-site) emergency planning with 
the responsibilities placed on the local authorities (at 
county level) (para 102). 

169 We believe it is essential that all emergency plans 
be discussed between industry, the local authorities 
and the emergency services, and periodically rehearsed 
(para 97). 

170 We recommend that the CIA be asked to publish 
guidance covering industry’s role in emergency 
planning off-site (para 101). 

171 We suggest that the Home Office be asked to 
consider the revision of its joint Circular ES 7/1975 to 



take fuller account of major industrial accidents (para 
103). 

172 We recommend that the HSE should actively 
pursue the ways in which local medical services should 
prepare to deal with toxic emergencies in their 
localities (para 106). 

Planning 

173 We still believe that the decision on whether or 
not to grant planning permission for a hazardous 
installation should continue to rest with the local 
planning authority (para 111). 

174 We believe it essential that local planning 
authorities should fully understand the weight to be 
attached to the HSE’s advice and that discussions 
should take place between all interested parties to 
identify and resolve any difficulties or problems (para 
114). 

175 We recommend that government departments be 
asked to give further consideration to the amendment 
of the Town and Country Planning Act 1971 at the 
first possible opportunity to close the significant 
loophole in planning controls for notifiable 
installations (para 118). 

176 We recommend that government departments be 
asked to give further consideration to present 
compensation arrangements (paras 120 and 121). 

Education 

177 We believe that an enlightened attitude towards 
safety in senior management is the key to establishing 
the appropriate climate throughout the whole 
organisation (para 123). 

178 We recommend that industry should be willing 
to release staff to attend courses aimed at improving 
their safety awareness and performance (para 127). 

179 We recommend that there should be more short 
courses available and that the longer courses should 
have a modular structure (para 127). 

180 We recommend that other professional 
institutions follow the example of the Institution of 
Chemical Engineers in the development of safety 
training (paras 124, 125 and 128). 

Research 

181 We believe that a great deal of scientific research 
has been done in the major hazard field and much has 
been published (paras 130 and 131). 

182 We believe that it is of great importance that 
organisations maintain a liberal policy in relation to 
the publication of research work (para 130). 

183 We support the view that some mechanism 
should be set up to coordinate research on human 
reliability (para 134). 
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184 We believe there is need for further work on: 

(a) in-service monitoring and inspection techniques 
(para 133), 

(b) factors affecting the emission of hazardous 
materials (para 137), 

(c) dispersion of heavy gas clouds (para 139), 

(d) vapour cloud explosions (para 140), 



(e) fireballs (paragraphs 12 and 141), 

(f) toxic substances (para 142) and 

(g) the effects of major accidents on the surrounding 
population (para 143). 

185 We believe there is need for satisfactory systems 
for the collection, classification, storage and retrieval 
of data from incidents (paras 144 and 145). 
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Glossary 



This glossary does not aim to be a dictionary of 
technical terms. Firstly the terms are restricted in 
number and secondly it is not intended to define them 
for general use. We acknowledge that other meanings 
may be given to these terms in everyday speech, in 
technical contexts and in industry. The purpose of the 
glossary is to give the meaning of certain terms as they 
are used in the report. 

At risk see Risk. 

Bund, bunding a system of containment for catching 
liquid spillage. It may take the form of a low wall 
surrounding the area or a shallow pit, or some 
combination of the two. 

Catastrophic fire see Fire. 

Competent authority the Authority set up or 
appointed by a member state to fulfil the requirements 
of Article 7 of the Directive. 

Condition monitoring surveillance of the condition of 
plant equipment by visual observation and, more 
particularly, by instrumentation, on a periodic or 
continuous basis, in order to obtain early warning of 
the development of defects or malfunctions. 

Cryogenic fluid a gas liquefied by refrigeration at 
temperatures below those encountered in nature on the 
earth. Examples are liquefied natural gas and liquid 
oxygen. 

Development a legal term having the meaning 
“Carrying out of building, engineering, mining or 
other operations in, on, over, or under land, or the 
making of any material change in the use of any 
buildings or other land”. 

Dioxin dioxin is the common name for 2, 3, 7, 8 — 
tetrachlorodibenzo-p-dioxin. It was the principal cause 
of harm in the Seveso disaster in 1976. It is a solid 
substance which, in minute quantities in contact with 
the skin, gives rise to the disfiguring disease chloracne. 
It is highly toxic and extremely persistent. 

Domino effect a situation in which a major accident 
on one site gives rise to consequential accidents on a 
neighbouring site. 

Dust explosion an explosion which results from the 
ignition of a mixture of finely divided combustible 
solids and air. The effect of such an explosion is 
comparable with that which results from the ignition 
of an equal volume of air mixed with flammable 
vapour. 

Fault tree a diagram which expresses the logical 
relationship between the combinations of events which 
lead to an accident. The accident appears as the TOP 
EVENT of the fault tree. 
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Fire catastrophic fires are those which are 
distinguished from fires ordinarily encountered by 
their intensity, their rapidity of spread or their size, or 
some combination of these factors. 

Hazard a physical situation with a potential for harm 
to life or limb. 

Hazard assessment a formal, systematic appraisal of 
the nature and magnitude of the hazards associated 
with an installation. 

Individual risk see Risk. 

Intelligent pig an inspection device which passes 
down a pipeline to detect and locate flaws in the 
pipe wall. 

Loss prevention an approach to safety in the chemical 
and process industries distinguished by an emphasis 
upon incorporating safety into the initial design of 
plant and equipment. 

Major hazard a hazard which has the potential for 
major harm to employees, the public or the 
environment. 

Notifiable installation an installation which is 
required to be notified to the HSE under the NIHHS 
Regulations 1982. 

Reliability the probability that an item will perform a 
required function under stated conditions for a stated 
period of time. 

Risk in the general sense this means the chance that 
an undesirable or harmful event will take place. It is 
also used more precisely in quantitative analyses to 
mean the calculated probability of the realisation of a 
hazard. 

Risk, at subject to a significant probability of harm if 
a given hazard be realised. 

Risk, individual the probability of an individual being 
harmed as the consequence of a specified hazard. 

Risk, societal the probability of a defined number of 
people being harmed as the consequence of a specified 
hazard. 

Scaling laws laws which relate quantity of hazardous 
substances to the consequences of the realisation of the 
hazard. 

Societal risk see Risk. 

Stress concentration a property of a component under 
stress whereby stress in some locations has a value 
many times greater than the mean value. 

Top event see Fault tree. 
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Abbreviations used in male report 



CIA 

CIMAH 

DOE 

HMFI 

HSC 

HSE 

HSW Ad 
LPG 
NIHHS 
Regulations 



Chemical Industries Association 
Control of Industrial Major Accident 
Hazards Regulations (Draft) 

Department of the Environement 
Her Majesty’s Factory Inspectorate (part 
of the HSE) 

Health and Safety Commission 
Health and Safety Executive 
Health and Safety at Work etc Act 1974 
Liquefied Petroleum Gas 
Notification of Installations Handling 
Hazardous Substances Regulations 1982 
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Appendix 1 Brief outline of the First and 
Second Reports of the Advisory Committee on 
Major Hazards 



First Report 1976 

Nature of the problem. Increase in both industrial 
plant size and the development pace of related 
technology has produced a social reaction. The need is 
demonstrated for the establishment of controls for new 
industry which balance safety requirements against 
practical economic factors. HSW Act 1974 provides 
basis for such a control system, (pages 9-10) 

Identifying major hazards and assessing risk. The 
nature of flammability and toxicity threats. Although 
the full potential of a hazard was seldom realised the 
minimisation of risk was necessary. Recognition that 
complete elimination of plant failure was itself 
impossible. Consideration of quantitative objectives in 
risk assessment, (pages 11-13) 

Notifiable installations. Outline scheme for 
notification, survey, assessment and appraisal of 
various categories of hazardous installations. List of 
various categories of installation. There was a 
requirement to submit hazard surveys of plant, 
procedures and hazard methods to HSE, leading to the 
possible selection of installations requiring more 
elaborate risk assessment by a specialist unit, (pages 
14-18) 

Application of controls to major hazard installations. 
The role of management seen as the dominant factor 
insomuch as they must satisfy HSE standards; but 
control methods should not dilute final managerial 
responsibility. Discussion of control methods: 

Codes of Practice 
Licensing Regulations 

No new sub-standard installations should be allowed 
whilst existing installations should be brought up to 
adequate standards, (pages 19-22) 

Planning controls. Hazardous installations siting 
should be part of general area planning considerations. 
Case for the formalising of existing HSE/local 
authority consultative arrangements prior to planning 
permission decisions. Investigation of control over 
hazardous process variations not covered by present 
planning arrangements. Possible effect of restrictive 
planning controls on compensation claims made to 
local authorities. The complexity of practical issues 
involved necessitated further discussion with the 
Department of Environment, (pages 23-25) 

Second Report 1979 

The examination of historical experience and the 
frequency and consequences of major hazard incidents. 



Data seen as generally supporting the levels at which 
inventories should be notifiable. Consideration of 
theoretical prediction techniques, (pages 10-18) 

Justification of inventory levels in the proposed 
schedule of specific substances. Developing thoughts 
on the survey, assessment and appraisal of various 
categories of installations led to the definition of 
priority sites which would need hazard surveys as 
those with 10 times the notification level of inventory, 
(pages 19-22) 

Evidence of installation operators in defence of 
existing safety procedures. Consideration of ‘Licensing’ 
regulations as further controls and an outline scheme 
for licensing (Appendix 1). Further discussions 
intended when proposed notification regulations have 
been practically evaluated, (pages 23-26) 

Hazardous development locations regarded as a matter 
for planning authorities. Limitations of the present 
planning controls over the introduction or the increase 
of hazardous processes at existing installations. Means 
whereby planning controls may be applied to new 
sites, intensified activity at existing sites and 
surrounding area development. Possible effect of 
restrictive planning controls on compensation claims 
to local authorities with a suggested Department of 
Environment response. Practical considerations of 
siting problems, (pages 27-31) 

Recent knowledge on the formation, behaviour and 
explosion of vapour clouds. Discussion of factors 
affecting the magnitude and destructive effect of 
vapour cloud explosions, (pages 32-39) 

Discussion of explosive vapour cloud hazard areas and 
the location, function, design-criteria and siting of 
management control buildings. Examination of vapour 
explosions on control buildings at Flixborough and 
Beek. Flying glass problems, (pages 40-45) 

Safety of personnel on site considered as of parallel 
importance to the consideration of plant and buildings 
at the planning and design stage. Establishment of 
categories of people and hazard areas relative to risk, 
and discussion of the buildings, siting, construction 
and access limitation within site boundaries. The 
essential features of formalised procedures and permits 
in designated areas, (pages 46-48) 

Findings of the working group on research. Evaluation 
of available data to identify areas of continuing 
concern in the major hazards field. Discussion of 
heavy gases dispersal problems, related trials and 
recommendations. Encouragement of collaboration at 
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international, governmental and industrial levels, 
(pages 49-51) 

Identification of areas requiring further committee 
consideration, (pages 52-53) 

Conclusions and recommendations of the Committee. 

Notification and inventory 
Hazard assessment 
Hazard surveys 
Legal controls 
Planning 

Explosion hazards 
Site safety (pages 54-55) 
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Appendix 2 Major Hazard Aspects pf 
Transport: ACMH Report to HSC 



Introduction 

In June 1981 the Health and Safety Commission asked 
us to “consider whether there are any aspects of the 
transport of dangerous substances which have the 
potential to create a major hazard to employees or to 
the public or to the environment” and to report back 
within one year. In response, we formed another 
Working Group (Group F) with the following 
members: Professor J L M Morrison (Chairman), 

S Hope, V C Marshall, Professor J F Richardson, 

E J Challis* and H E Lewis*. B H Harvey, ACMH 
Chairman, attended as an ex-officio member of the 
Working Group. 

This paper is based upon the discussions of that 
Group. 

We were not required to consider the matter in depth 
but to make such preliminary enquiries as would 
establish prima facie whether or not further work was 
called for. In that context therefore, we have talked 
only with representatives of regulating authorities, and 
with the exception of British Rail, have approached 
neither users nor other commercial interests. In one 
sense our task was simple — if dangerous substances 
are transported in or above the quantities which the 
Commission has accepted as appropriate for 
identifying static major hazard installations then a 
potential major hazard situation must exist. This 
applies to quantities which merit notification and more 
so to quantities which merit hazard surveys. 
Nevertheless we felt that the Commission would 
require us to give indications of the particular aspects 
of the various modes of conveyance which appear to 
merit further investigations. We also believe that 
examples of the aspects we have been considering 
would add substance to our recommendations. 

As in the case of static installations we have been 
concerned to identify possible circumstances in which 
a major accident involving transportation of dangerous 
substances could affect non-employees or members of 
the public as well as the workers directly concerned. 
Although during a long journey the people at risk are 
constantly changing and individuals may be only 
exposed to the hazard for a short time, the total 
number affected by a quantity of a dangerous 
substance may be larger than at a factory where it is 
produced or used. We have examined the principal 
modes of the bulk transport of hazardous material 
namely those of sea, rail and road. 

* Co-opted members 



Pipelines had already been considered by another of 
our Working Groups and their findings have been 
reviewed by us and are summarised below. In all these 
forms of transport quantities of hazardous substance 
are carried in excess, and in some cases greatly in 
excess, of the quantities that we recommended should 
constitute a major hazard threshold for fixed 
installations. Serious incidents involving the transport 
of dangerous substances in various parts of the world, 
(none yet in the UK) confirm the potential hazard that 
exists. Incidents which have attracted particular 
attention have been: 

(a) At Bantry Bay, Ireland, in June 1979 where fifty 
people died following a serious leak of oil and an 
explosion in connection with the unloading of the 
tank ship Betelgeuse. 

(b) At Mississauga, Canada, in November 1979 where 
a freight train of mixed cargo including propane 
and chlorine derailed with subsequent fire and 
explosion. Over two hundred thousand people 
were evacuated because of the toxic hazard from 
the possible release of chlorine. 

(c) At San Carlos, Spain, in July 1978 where a road 
tanker carrying about 22 tonnes of propylene 
ruptured near a camp site killing over 200 people 
in the ensuing conflagration. 

(d) At Port Hudson, Missouri, USA, in December 
1970 where a pipeline ruptured releasing a 
considerable quantity of propane which on 
ignition at a nearby unoccupied farm house led 
to one of the largest known vapour cloud 
explosions although no one was killed. 

(A summary is given in the Annex of these and some 
other well known transport accidents which have been 
taken in part from Chapter 1 of our Second Report.) 

It might not be wholly inappropriate to mention at 
this point three very recent accidents in this country. 

(a) At Milford Haven, in December 1981 where the 
Hullgate , a small (3000 tonnes) oil tanker with a 
cargo of 500 tonnes of petrol, was taking on 
approximately 7000 litres (1500 gallons) of 
bunker fuel. An explosion occurred in which one 
man died and six other crew members were 
injured. Firemen and dockers fought successfully 
to keep the ensuing fire from spreading to the 
petrol. A neighbouring large tanker was safely 
towed away and no damage was done to any of 
Milford Haven’s four oil refineries, in which 
however all work was suspended during the 
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emergency. This incident could be regarded 
perhaps as a ‘near miss’: on the other hand it 
could be taken as redounding to the credit of the 
safety precautions and personnel. 

(b) At Gainsborough in September 1981 where 16 
tank wagons in a freight train were derailed. Two 
empty 100 ton g.l.w. wagons that normally carry 
petroleum spirit were badly damaged and had 
their tanks ruptured. This accident was 
potentially serious and was caused by minor 
track defects and excessive train speed. Also at 
Seer Green where a passenger train ran into the 
rear of a stationary train we note from press 
reports issued at the time that the incident 
occurred in severe weather conditions and that 
there appeared to be a lack of communication 
between the drivers of the train and the 
signalmen. No doubt these aspects will be part of 
the considerations of the official inquiry. 

I Sea transport 

Hazardous substances are transported by sea in 
quantities which are enormous even in major hazard 
terms. Bulk carriers carry many times the amount 
which has now been defined as a major hazard at a 
static installation. For example, notifiable levels set 
down in our Second Report for chlorine, ammonia 
and LPG were 10, 100 and 30 tonnes respectively; 
whereas ships entering UK ports might carry 2,000, 
10,000 and 30,000 tonnes of the same substances. Such 
ships may penetrate estuaries, harbours and narrow 
channels to take them through or into large centres of 
population where other vessels may use some of the 
same facilities. They are subject to winds, tides and 
currents: controlling and manoeuvring such large 
Boating structures is inherently difficult. In our reports 
on land-based installations, we have emphasised the 
vital role which sound construction and maintenance, 
together with competent management, must play. Our 
present, admittedly limited, enquiries into recent 
incidents do not reassure us that these are universally 
achieved in relation to shipping. Although the 
proportion of poor ships and crews may be very small, 
it has to be remembered that Very Large Crude 
Carriers alone berth about 300 times annually in this 
country. 

There are national laws and international conventions 
for the seaworthiness and safe operation of ships but 
their effectiveness is called into question by incidents 
such as that at Bantry Bay involving the Betelgeuse 
and at Rotterdam involving the Energy 
Concentration. We have noted, however, the recently 
introduced Statutory Instrument No. 1077 “Merchant 
Shipping — The Merchant Shipping (Tankers) (EEC 
Requirements) Regulations 1981” which came into 
operation in October 1981 and which, if effective, 
should help to identify situations where standards and 
procedures are below the acceptable level. 

To minimise the risks of a major hazard disaster there 
must be clear definitions of the functions of the ship’s 



crew, of the personnel of the shore installation and of 
the harbour authorities and there must be adequate 
systems of communication between them. One aspect 
that has emerged from our enquiries was that 
transport of dangerous cargoes by sea appears to be 
the subject of a number of different regimes of control, 
not only as a vessel moves from the high seas into a 
port but also because controls regarding design and 
construction are to some extent separate from controls 
regarding operation. These factors lead to a very 
complex situation and we consider that much more 
time could usefully be spent in determining the 
interrelationship of the various responsibilities. 

For commercial reasons, ships load and discharge their 
cargo very rapidly and as a consequence the pipes 
transferring the liquid cargo, flammable or toxic, are 
as large and the rates of flow are as high as is 
practical. In the event of a fracture of the loading 
system, even if the automatic cut-off devices work 
properly, spillages of the order of tens of tonnes may 
still occur. In the event of the failure of the cut-off 
devices spillages may be very much larger. 

We are also concerned with the application of 
planning controls at or near ports or harbours that 
handle major hazard quantities of hazardous material. 
We consider that the relevant planning authorities 
should appreciate the nature of the hazard involved in 
a way similar to that being evolved for static major 
hazard installations. We, however, in the time 
available were unable to pursue this aspect to any 
extent. 

We therefore consider that further study should be 
undertaken, 

(a) to determine the interrelationship of the various 
regimes of control for vessels carrying major 
hazard cargoes into ports and harbours; 

(b) to review the possible role of hazard analysis for 
certain operations and in particular stowage, 
loading and discharging, and 

(c) to consider the application of planning controls 
for developments at and in the vicinity of ports 
and harbours handling major hazard cargoes. 

II Rail transport 

This mode of transport provides a complete contrast 
in that one operator, British Rail, is responsible for the 
vast majority of the system and handles most if not all 
the major hazard quantities of hazardous substances. 
There is also a single regulatory authority, the 
Railways Inspectorate. Although the carriage of 
dangerous material (explosive, toxic, or flammable) by 
rail in quantities comparable with the limits suggested 
for fixed installations must be regarded as constituting 
a major hazard, and there is ample evidence as 
detailed in our Second Report that these hazards can 
be realised, it is noteworthy that not one of the 
incidents cited therein occurred in this country. Indeed 
our discussions with the Railway Inspectorate and 
British Rail have impressed us with the care taken to 
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avoid accidents and to minimise consequences. Even 
so, accidents do still occur, due mainly to derailments 
or occasionally to collisions; but a rate reduced to 
about one in about 10 8 tonne-miles must be seen as 
commendable. Still striving for improvement, British 
Rail have plans for a wide range of projects including 
the use of computers for the separation of 
incompatible loads, re-routeing, better 
communications, improved vehicle construction and 
the like. 

One aspect of rail transport attracted our attention. 

This was the need to have marshalling or reception 
yards where freight trains might be held awaiting 
onward movement. It was clear from the discussions 
that considerable quantities of hazardous substances 
could be held at any one time. We considered that for 
such sites it would not be unreasonable for the 
operator to undertake the equivalent to a hazard 
survey if the total quantity was liable to exceed a given 
amount. We were not clear also as to the extent to 
which such sites were subject to planning requirements 
and in particular considered that planning authorities 
should be required to consult HSE in relation to 
developments in this vicinity. 

Although we understand that considerable 
improvements have been made in communications 
facilities between trains and signal staff, we would 
suggest that good communication is an essential 
element for the safe movement of major hazard 
quantities of hazardous substances and particularly in 
a post accident situation. 

We also were concerned about the routeing of 
hazardous loads. British Rail said that, in general, 
there was little flexibility available. The Group 
however considered that when such flexibility existed it 
should be made use of and felt strongly there should 
be some control of movements in particular sections of 
the route, such as long tunnels'", where there might be 
grounds for imposing some restriction on the 
simultaneous movement of trains carrying passengers 
and major hazard quantities of dangerous materials. 

HI Road 

In our Second Report we touched on the major hazard 
implications of road transport. A very large amount of 
dangerous material is transported by road. Although 
the maximum quantity of material likely to be 
involved in any one accident will be much less than in 
a shipping or rail incident, considerable quantities are 
being carried through centres of large population and 
therefore accidents with serious major hazard 
consequences could occur at any time. In the UK, the 
recent introduction of Regulations for Road Tankers 
(SI 1981 No. 1059) has been noted and should, in our 
view, improve the controls and lead to a safer system. 
It must be realised, however, that road transport is 
unique in that the road system is universal with the 

* Wc understand that this is now current practice for the Severn 
Tunnel. 



result that the opportunity for accidents is widespread 
and intimate. It is that factor which accounts for 
public apprehension. Nevertheless, we doubt if any 
general enquiry into road transport is warranted but a 
number of matters appear to require further 
consideration, the most obvious of these are loading 
and unloading terminals, routeing and intermediate 
stopping places. The last aspect includes the overnight 
parking of vehicles which may not only be dangerous 
in themselves but whose loads may be incompatible 
with other loads. Parking or staging posts introduce 
planning problems comparable with those for fixed 
installations and for sea and rail transport as outlined 
above. 

IV Pipelines 

Some of our earlier investigations of pipelines 
concluded that, while these can be well designed, 
constructed, and operated, to provide a safe means of 
transport there is a major hazard threat when certain 
materials are carried. 

This arises from the fact that large quantities of 
hazardous substances are carried through the public 
domain and could be released in the event of an 
accident. The potential threat differs somewhat from 
that posed by other forms of transport in that the risk 
to the public is permanent and present along the whole 
length of the pipeline and in this sense is akin to that 
of a fixed installation. Pipelines are however a form of 
transport and the risks involved could and perhaps 
should be compared with those for other forms of 
transport. 

With regard to controls it is our view that the 
provisions of the Health and Safety at Work Act, 
which includes, as relevant statutory provisions, the 
safety sections of the Pipe-line Act 1962, provides an 
adequate statutory system. It is also our understanding 
that attention has been paid in recent years to the 
major hazard aspects of pipelines, both by the HSE 
and the Pipelines Inspectorate. 

V Air 

We are satisfied that the dangerous substances 
transported by air in themselves do not constitute a 
major hazard to the public. There may however be 
some merit in considering how the comprehensive 
controls exercised over all aspects of air traffic may 
have useful lessons to offer to other modes of 
transport. 

Conclusions 

Despite the obvious and significant differences in the 
circumstances of the various modes of transport, we 
found that certain themes recurred. In each field the 
authorities appeared to be introducing additional 
controls designed to prevent loss of containment, to 
give precise warning of the dangers if this occurred, 
and to prescribe emergency measures to counteract it 
if it did occur. Less attention appeared to be paid to 
the conditions under which dangerous substances were 
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handled between various phases of their journey, e.g. 
at staging posts, in marshalling yards, etc and this is 
an area which we noted particularly as calling for 
investigation in all modes. Loading and unloading 
concerned us in particular. Here there were some 
obvious sources of potential hazard, e.g. failure of 
temporary connections. We were not convinced that 
responsibilities were always clearly defined and 
properly allocated when the loads were being 
transferred. 

There are several practical considerations which limit 
the available means of transport in any particular case. 
Safety is important, and although any method finally 
chosen must be safe enough, the relative margins of 
safety between methods may well not be a decisive 
factor. In the short time so far available to us we have 
not tried to establish any facts on the relative safety of 
different systems of transport for the same substance. 
Even if only one method of transport is practicable, in 
a given case, then the route which is used can be of 
prime importance in reducing the number of people at 
risk. 

Thus we believe that the major hazards aspects of the 
transport of hazardous substances should receive 
further consideration. In our preliminary study the 
following areas have appeared to us to merit further 
consideration; there may be others: 

(a) The application of hazard surveys in a way similar 
to that we have already recommended for fixed 
installations and in particular to 

(i) parking or overnight storage sites (transit 
depots). This has special relevance for road and 
rail transport. 



(ii) loading and unloading. This applies to road, 
rail and sea but the last should receive special 
consideration in view of the vast quantities that 
are transferred in a relatively short time. 

(iii) the movement of hazardous quantities of 
material as an identifiable unit. 

(b) The planning arrangements for 

(i) transit depots (road and rail) 

(ii) loading/ unloading sites (all forms of 
transport) 

(iii) nearby developments which may be affected 
by (a) and (b). 

(c) The interrelationship and effectiveness of the 
various systems of control and the responsibilities 
for the various aspects of sea transport in ports 
and harbours. 

(d) The feasibility of comparing risks in various forms 
of transport. 

(e) The possibility of routeing to minimise the risk to 
the public. 

(f) The need to provide adequate communication to 
and from the person in control of the hazardous 
cargo in transport to ensure prompt response in 
the event of an incident. 

The Health and Safety Commission is invited to 
consider if further investigation is necessary. 



Annex 

SHIPPING 



Quantity Consequences 

Date of Total Actually Nature of Source of 



incident 


Location 


Area/ site 


Substance 


available 


released 


incident 




Fatalities information 


16 January 
1976 


Landskrona 
Sweden 
(“Rene 16”) 


Docks 


Anhydrous 

Ammonia 


533 tonnes 


180 tonnes 


Rupture of 
rubber 
liquid 
hose 


Release, 
formation 
of toxic 
cloud 


2 Ammonia 

Plant Safety 
Vol 19(1977) 


30 December 
1978 


Sullom Voe 
Shetland 
(Esso 
Bernicia) 


Terminal 

Jetty 


Fuel Oil 




1 174 tonnes 


Ship 

collided 

with 

jetty 


Fuel tank 
ruptured and 
contents 
released on 
to sea 


0 New 

Scientist 
26 April 
1979 


8 January 
1979 


Bantry Bay 

Ireland 

(Betelgeuse) 


Terminal 

Jetty 


Heavy 
crude oil, 
light 

crude oil 


75.000 tonnes 

40.000 tonnes 


? 

? 


Incorrect 

ballasting 

caused 

corroded 

hull to 

buckle 


Fire and 
explosion 
of cargo 
vapours 


50 Official 

Enquiry 
Report 


30 August 
1979 


Good Hope 

Louisiana 

USA (Inca 

Tapuo 

Yupanqui, 

Panama 


Mississippi 

River 


General 

cargo 

Butane 


600 tonnes 
(7,000 barrels) 


600 tonnes 
(7,000 barrels) 


Freighter 

collided 

with barge, 

ruptured 

butane 

tanks 


Butane 
exploded 
and formed 
fireball 


12 NTSB 

Report 



City) 
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SHIPPING 











Quantity 






Consequences 






Date of 
incident 


Location 


Area/ site 


Substance 


Total 

available 


Actually 

released 


Nature of 
incident 




Fatalities 


Source of 
information 


24 July 
1980 


Rotterdam 

Holland 

(Energy 

Concentra- 

tion) 


Terminal 

Jetty 


Crude Oil 


150,000 tonnes 


? 


Incorrect 
unloading 
caused 
vessel to 
split 

amidships 
and sink 


No fire or 
explosion 


0 


Press 

Reports 


3 August 
1981 


Solent 
Nr South- 
ampton UK 
(Melpo 
Lemos) 


Inland 

Waters 


Crude Oil 


150,000 tonnes 




Vessel 

ran 

aground 


No release 
of cargo 


0 


Lloyds 

Report 


RAIL 


28 June 
1959 


Meldrim 

Georgia 

USA 


Rural/ 
Picnic Area 


LPG 


36 tonnes 


18 tonnes 


Derailment 
Tank 
ruptured 
by coupler 


Tank 

breached and 

released 

contents, 


23 


Interstate 
Commerce 
Commis- 
sion Reporl 



minor 

explosions 

and 

subsequent 

flash-fire 



18 February 
1969 


Crete 

Nebraska, 

USA 


Urban 


Anhydrous 

Ammonia 


90 tonnes 


21 January 
1970 


Belle 

W. Virginia 
USA 


Urban 


Anhydrous 

Ammonia 


75 tonnes 


19 July 
1974 


Decatur 

Illinois 

USA 


Urban 
(Rail yard) 


Isobutane 


69 tonnes 


10 November 
1979 


Mississauga 

Canada 


Urban 


1 1 Tanks 
Propane 

3 Tanks 
Toluene 

4 Caustic 
Soda 

1 Tank 
Chlorine 
3 Tanks 
Styrene 


90 tonnes 


31 July 
1981 


San Luis 

Potosi 

Mexico 


Urban 

(Railway 

Station) 


Mixed 
freight 
including 
Chlorine 
(6 vehicles) 


3,200 tonnes 



90 tonnes 


Derailment 


Total release 


3 from 


NTSB 




Tank 


of contents 


derail- 


Report 




fractured 


to form toxic 


ment 






on impact, 


cloud 


6 from 
exposure 

to toxic 
cloud 




75 tonnes 


Tank car 


Total release 


0 


Safety in 




collision 


of contents 




Ammonia 




and puncture 


to form toxic 




Plants — 




of tank 


cloud 




1970 


69 tonnes 


Tank car 


Total release 


7 


NTSB 




collision 


of contents. 




Report 




and 


ignition of 








puncture 


cloud and 








of tank. 


explosion 








Derailment 


Explosion 


0 


Chemical 




of mixed 


and fire 




Age 




freight 


ruptured 




Press 




wagons. 


propane 




Cuttings 




3 propane 


tankers & 








tanks 


chlorine 








exploded 


tanker which 






70 tonnes 




leaked 
contents — 
250,000 










persons 

evacuated 






90-150 tonnes 


Derailment 


Release of 


14-20 


Press 




and tank 


contents to 


deaths 


Cuttings 




breached 


form toxic 


280 








cloud which 


affected 








spread over 


by toxic 








wide area 


vapours 
but subse' 










quently 










recovered. 
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ROAD 



Quantity Consequences 



Date of 
incident 


Location 


Area/site 


Substance 


Total 

available 


Actually 

released 


Nature of 
incident 




Source of 

Fatalities information 


25 July 
1962 


New Berlin 
New York 
tjSA 


Urban 


Propane 


13 tonnes 


13 tonnes 


Failure of 
tank caused 
by jack- 
knifing on 
collision 
with tree 


Release of 
tank contents 
resulted in 
fire 


10 


NFPA 
Quarterly 
July 1963 


21 August 
1968 


Lievin 

France 


Urban 


Ammonia 


19 tonnes 


19 tonnes 


Tank 
collapsed 
due to 
corrosion 
and stress 
fatigue 


Release of 
tank contents 
to form cloud 


6 


Ammonia 
Plant Safety 
Vol 12. 
AICLE 


23 October 
1970 


Hull, UK 


Urban 


Propane 


2 tonnes 


0.1 tonnes 


Control 
valve and 
protective 
dome of tank 
sheared off 
in collision 
with subway 
roof. 


Partial 
release of 
tank contents 
to form cloud 
and 

subsequent 
flash fire. 


2 


Police 

Report 


8 December 
1972 


Nr Wigan 
UK 


Rural 


Oleum 


20 tonnes 


15 tonnes 


Tanker 
collided 
with another 
vehicle in 
thick fog 


Tank ripped 
by corner of 
the other 
vehicle, 
contents 
leaked out, 
pool formed 
with heavy 
fumes 


1 


Press 

Report 


11 May 
1976 


Houston 

Texas 

USA 


Urban 


Ammonia 


19 tonnes 


19 tonnes 


Vehicle 
crashed and 
fell 30 
feet. Tank 
ruptured on 
impact 


Release of 
contents to 
form cloud 


6 


City of 
Houston 
Health Dept 
Review 


4 January 
1978 


Nr. 

Hatfield 

UK 


Rural 


Petrol 


19 tonnes 


19 tonnes 


Vehicle 
involved 
in multiple 
crash and 
tank 
ruptured 


Release of 
contents 
followed 
by ignition 
and fireball 


0 


Press 

Report 


1 1 July 
1978 


San Carlos 
Spain 


Nr Camp 
Site 


Propylene 


22 tonnes 


22 tonnes 


Rupture 
of over- 
filled 
tank 


Release of 
contents 
followed by 
by ignition 
and flowing 
fireball 


200 


Press 

Report 


16 July 
1978 


Nr. Tula 
Mexico 


Rufal 


Butane 


4-23 tonnes 


4—23 tonnes 


Vehicle 
crashed 
and over- 
turned. 
Tank 
ruptured 


Release of 10-15 

contents 

followed by 

ignition 

and explosion 


Press 

Report 


PIPELINE 


9 December 
1970 


Port Hudson Rural 

Missouri 

USA 


Propane 




360 tonnes 


Pipe-line 
failed due 
to corrosion 


Contents 

released 


0 


USA Dept 
of the 
Interior — 
Report 


22 February Austin 
1973 Texas 

USA 


Rural 


Natural Gas — 
Liquids 
(Methane to 
Hexanes) 


530 tonnes 


Pipe-line 
failed due 
to pipe 
stress 


Contents 
released and 
ignited 


6 


NTSB 

Report 

PAR-73-4 


21 May 
1974 


Meridian 

Mississippi 

USA 


Rural 


Natural Gas — 


? 


Pipe-line Contents 

failed due released 

to internal and ignited 

corrosion and 
embrittlement 


5 


NTSB 
Report 
PAR-76- 1 
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PIPELINE 









Quantity 






Consequences 






Date of 
incident 


Location Area/site 


Substance 


Total 

available 


Actually 

released 


Nature of 
incident 




Source of 

Fatalities information 


12 May 
1975 


Devers Rural 

Texas 

USA 


Ethane/ 

Propane 

Mixture 




800 tonnes 


Pipe-line 
failed due 
to pipe 
stress 


Contents 
released, 
ignited and 
subsequent 
explosion 


a' 


NTSB 

Report 

PAR-76-5 


20 July 
1977 


Ruff Creek Rural 

Pennsylvania 

USA 


Propane 




145 tonnes 


Pipeline 
failed due 
to stress 
corrosion 
cracking. 


Contents 
released, 
ignited and 
caused flash 
fire 


2 


NTSB 
Report 
PAR-78- 1 


4 August 
1978 


Donnellson Rural 

Iowa 

USA 


Propane 




300 tonnes 


Pipeline 
failed due 
to combined 
stresses and 
weakening of 
line caused by 
a dent and 
gouge 


Contents 
released 
and ignited 


3 


NTSB 
Report 
PAR-79- 1 
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Appendix 3 The EC Directive on the major 
accident 'hazards of certain industrial 
activities: 1 1 rief outline 



Directive’s scope 

The EC Directive is concerned with the protection 
from major accidents of the health and safety of 
persons at work and others likely to be affected, and 
with the protection of the environment. It applies to 
industrial activities defined in two ways. 

The first definition is in terms of a wide range ot 
processes which cover most manufacturing or 
production activities involving certain dangerous 
substances. The relevant substances are set out in 
Annex III to the Directive with appropriate threshold 
quantities at and above which the various 
requirements apply. 

The second definition of industrial activity is isolated 
storage involving some named dangerous substances at 
specified threshold quantities. These substances are set 
out in Annex II to the Directive. 

General requirements 

There are two general requirements. The first requires 
the person in control of any industrial activity where a 
major accident might occur to be able to provide at 
any time evidence which shows that major accident 
hazards have been identified; that steps have been 
taken to prevent such accidents, and that persons 
working on site have been provided with the 
information, training and equipment necessary for 
their safety. This requirement supplements the general 
duties imposed on employers by the HSW Act. 

The second general requirement requires manufacturers 
to inform the ‘competent authority’ i.e. in the UK the 
HSE, immediately of any major accident. Further 
information will also be required on the effects of the 
accident, the emergency measures taken and of any steps 



taken to alleviate medium or long-term effects and to 
prevent a recurrence of the accident. This requirement is 
not linked to any threshold level. This information about 
major accidents will be passed on to the European 
Commission who are to establish a register of major 
accidents for the use of Member States. 

Special requirements for larger installations 

There are major requirements applying to installations 
classified as presenting a special potential for a major 
accident. These fall mainly on the manufacturer who 
must 

(a) produce a written report (or ‘safety case’) on the 
hazards and their control, 

(b) prepare an emergency plan for dealing with 
accidents and emergencies at his site and 

(c) provide information to people who might be 
affected by an accident. 

In addition a competent authority is required to draw 
up an emergency plan for dealing with the olf-site 
effects of major accidents. 

The Directive requires people who are liable to be 
affected by a major accident to be informed of the 
safety measures and of the correct behaviour to adopt 
in the event of an accident. 

Timescales 

The Directive required that by 8 January 1984 the 
requirements should apply for new industrial activities. 

For existing industrial activities all the requirements 
are expected to apply from 8 January 1985 with the 
exception of the requirement for a written report 
which must be fulfilled by 8 July 1989 at the latest. 
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Apf en lix 4 Transit warehouses: 
the Morley inci leni 



Working Group E) 



(by The Advisory Committee on Major Hazards — 

On Satuday 13 February 1982 a fire occurred at 
Quarry Lane, Woodkirk, Morley, Leeds in a 
warehouse storing paraquat and diquat-based 
herbicides contained in drums, plastic bottles and 
cardboard cartons, and also octylphenol in paper 
sacks. Though the fire brigade responded promptly an 
intense fire developed which consumed the octylphenol 
and much of the wooden pallet storage system. The 
fire resulted in a quarter of the herbicide stock being 
liberated, which drained, together with fire fighting 
water, into a water course in close proximity to 
housing. Widespread environmental pollution resulted 
from the incident when the River Calder became 
contaminated. The herbicide-saturated warehouse 
foundations continued as a source of contamination 
during rain storms long after the main consequences of 
the incident had been realised. No one was injured. 

After studying all available information we wish to 
express our concern about a number of issues. Firstly, 
in relation to the major accident hazards defined in the 
Seveso Directive the incident was small, but we feel 
that it may indicate future trends. The Directive 
requires potential environmental damage resulting 
from major hazard operations to be considered and 
such incidents to be reported though the chemicals 
involved at Woodkirk are not named in the Directive. 

Secondly, we are concerned that there is no 
appropriate system for the control of such 
warehousing, both in terms of siting and operation. 
The incident illustrated the need for appropriate site 
location and construction to provide containment in 
the event of a release of toxic chemicals, possibly 
diluted by fire fighting water, to prevent the 
contamination of natural drainage courses and potable 



water. This reflects also on the means of site access. In 
the incident the only site access road became 
contaminated soon after the fire started, thereby 
hampering fire fighting operations. We appreciate the 
numerous difficulties in establishing proper control 
over transit warehouse operations but are not satisfied 
that the present system of self regulation is adequate. 

Thirdly, concerning management aspects, we feel that 
as with chemical manufacturing plant someone with 
appropriate chemical expertise should be available on 
site to ensure that potential fire, explosion or toxic 
hazards are appreciated. 

Fourthly, we wish to comment concerning the storage 
of drums containing hazardous substances on sites 
devoted to distribution. The two principal 
requirements are that the storage location within the 
warehouse or yard is arranged so that fire or chemical 
interactions are minimised, and that an up-to-date 
inventory for each substance is maintained to ensure 
that guideline or notifiable levels are not exceeded, We 
would also wish to see the labels of those drums, 
bottles, cartons and bags which are destined for 
overseas markets bearing adequate English language 
descriptions to aid the emergency services when 
attending an incident in this country, before export. 

Fifthly, though forensic investigations have failed to 
establish the cause of the fire in this case, one of the 
potential ignition sources examined was the caravan 
used as office accommodation stationed within the 
warehouse. Portable buildings and caravans used 
within large buildings have been implicated in many 
fire incidents and we wish to, highlight the pptential 
fire hazard posed by their use in such circumstances. 



Printed image digitised by the University of Southampton Library Digitisation Unit 



A | pen six 5 1 he effects of loss of 

c< )n a inn iai it: emission 

(by B Fletcher — HSE) 



The topics covered by this phase of the work make up 
what may be called the source term; this term defines 
the physical composition of the emission as well as the 
rate of emission. 

The situation we are concerned with is that in which a 
breach occurs in a fluid-storage vessel or its associated 
pipework. The storage may be at ambient pressure and 
maintained by refrigeration, or at ambient temperature 
and maintained under pressure, or possibly at some 
intermediate combination of temperature and pressure. 

A fully refrigerated liquefied gas requires the addition 
of heat from an external source in order to evolve 
vapour. This source of heat is initially the ground or 
the walls of any secondary containment into which the 
liquid falls. The initial vaporisation rate is high and 
decreases thereafter as the contacted surfaces cool 
down. The source term for the dispersion calculation is 
therefore time dependent. The geometry and the 
thermal properties of the secondary containment (if 
any) will influence the magnitude of the source term. 
Judicious design can limit this magnitude and thus 
provides scope for control. 

With a pressurised liquefied gas, a proportion of the 
liquid will flash to vapour on release of the pressure. 
The liquid that remains will be at its boiling point at 
atmospheric pressure and will require heat transfer 
from an external source to produce vapour. The flash 
evaporation process will be vigorous and will result in 
fragmentation of some or all of the remaining liquid 
into finely-dispersed droplets. Surrounding air will be 
entrained in the process and sensible heat will 
therefore be available from this entrained air to cause 
further evaporation over and above the theoretical 
flash proportion. The production of fine droplets 
makes the flammable liquid readily available to any 
flame that may result. 

There is a variety of possible release conditions 
depending on whether the breach is above or below 
the liquid level, the size of the breach in relation to the 
cross section of the vessel, the storage conditions and 
the physical properties of the material. A detailed 
discussion of the various circumstances, with particular 
reference to ammonia as an example, is given by 
Griffiths and Kaiser (1979). 

The releases from the vapour space have been under 
investigation at the HSE laboratories and a recent 
paper (Fletcher, 1982) presented at a symposium on 
major hazard summarises the position. Even for small 
superheats (several degrees) very little liquid would be 
left in a vessel which fails such that discharge takes 
place through a hole which is large compared with the 
vessel cross-sectional area. In this case the liquid can 



be in the form of large drops which would fall back to 
the ground; as the superheat increases the droplet size 
will decrease and at large superheats the cloud could 
remain airborne as an evaporating aerosol. Estimates 
have been made using the HSE results on vapour 
discharge through small holes of the amount of liquid 
likely to be left in a ruptured container e.g. a railcar. 
Work has also been carried out at the Polytechnic of 
the South Bank by Nolan and Bradley (1982) on 
instantaneous catastrophic releases, and further 
research proposals are being submitted to the Science 
and Engineering Research Council. These include 
measurements of vapour, liquid and aerosol content 
and also variation of the droplet size of the aerosol 
spray with time. 

In the case of discharges from below the liquid level a 
considerable amount of work has been done in the 
past, mainly using water, to determine mass flow rates 
for two phase flows and to establish calculational 
techniques (see Henry 1981). These models usually 
assume homogeneous flow and equilibrium between 
the phases; this is probably a reasonable assumption 
for long pipes. Work by Fauske (1965) has shown that 
the mass flow rate of saturated and subcooled liquids 
passing through sharp edged orifices can be accurately 
described by the incompressible flow equation. For 
flow through short tubes Fauske (1965) showed that 
residence time within the tube has an effect and for 
this region there is no generally accepted model. Work 
is being carried out at the HSE laboratories on 
discharges from below the liquid level. 

Work on discharges from below the liquid level has 
been confined to those through tubes with a diameter 
of the order of a few millimetres. HSE has made 
proposals to the EEC Commission for sponsorship of 
larger scale experiments. 

dagger and Kaiser (1980) have attempted to link a 
model of the cloud formation phase with that for the 
dispersion phase but the lack of experimental evidence 
is presently a considerable inhibiting factor. The effect 
of storage conditions on cloud formation has also been 
considered by Hardee and Lee (1975) and by Maurer 
et al (1977). 

In the case of spillage of fully refrigerated liquid, the 
vapour formation is governed by heat transfer to the 
liquid from the surfaces with which the liquid comes 
into contact. There is rather less initial dilution of the 
vapour by entrained air during the formation stage 
than is the case with a Hashing liquid. Indeed, any 
dilution that there might be is ignored in estimating 
the initial cloud or plume properties. The initial 
conditions will be time dependent as, with increasing 
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time from release, the contacting surfaces reduce in 
temperature and the heat transfer rate falls. This is 
especially so if there is a secondary containment such 
as a bund able to retain all the released liquid. 

A literature survey of two-phase flashing jet flow has 
been carried out by Appleton (1982) under an 
HSE/SRD contract. Current models and 
computational procedures of the inception process, the 
jet structure and the subsequent entrainment process 
have been examined. No model was found which 
account for air entrainment. 

Areas which may be identifiable as ones in which 
further research could be carried out are atmospheric 
entrainment into flashing jets and the composition of 
flashing jets. The latter topic may form the natural 
extension to the work being carried out at the HSE 
laboratories at present. 

In each of the spenarios outlined above the spillage 
may result in the formation of a pool of evaporating 
liquid. An HSE/SRD Agency agreement project on 
the fundamentals of evaporation from pools is about 
to begin. The objective will be to produce an updated 
version of the computer code SPILL by carrying out a 
fundamental survey of the spread and evaporation of 
pools of cryogenic and non-cryogenic liquids on land 
and water and to validate this against available 
experimental data. 
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Appendix 6 Heavy gas dispersion 

(by N C Harris — formerly ICI pic) 



Some of the major releases of hazardous substances 
can lead to the formation of clouds of gas which are 
heavier than air. This is caused either by the material 
normally being a gas that has a density greater than 
air, or because in the release of a liquefied gas, liquid 
spray or aerosol formation has caused the air to be 
cooled below ambient towards the liquid boiling point, 
so creating a cloud of cold dense air and gas. The 
dispersion properties of dense clouds are known to 
differ from normal atmospheric dispersion, and 
accordingly the HSE mounted a series of tests in 1978 
at Porton Down, where the dispersion of sudden 
releases of 40m 3 of heavy gases was studied and some 
concentration data obtained. Since the scale of these 
experiments was very much less than that which might 
occur in accidents at present scales of operations, the 
HSE have undertaken a project, in conjunction with 
over 30 sponsors drawn from industry and other 
organisations around the world, to release 2000m 3 of 
heavy gas in further experiments on the former airfield 
at Thorney Island in southern England. A major 
increase in the number and quality of gas detectors 
used enabled much better gas dispersion data to be 
obtained. The results of these tests are to be analysed 
and submitted to the sponsors, but will later be 
published. 

Our Research Group and HSE have maintained 
contact with other organisations conducting large scale 
experiments, and those by Shell Research at Maplin 
Sands in the UK and by the US Dept of Energy at 
China Lake in California are of particular relevance in 
providing comparable data for study. 

Contact has also been established with many of those 
who have developed mathematical models to describe 
heavier than air gas dispersion, an area in which there 
has now been considerable progress over the last 
decade, and where good quality dispersion data from 
field experiments has been invaluable in refining the 
models and assisting in establishing satisfactory 
validation of them. In recent years, a major part of the 
examination of these models has been carried out by 
Prof J Havens of the University of Arkansas on behalf 
of the US Coast Guard, and he is linking this with a 
study of the experimental work in wind and water 
tunnels also being conducted in various parts of the 
world. He has found it possible to establish the broad 
set of mathematical equations of conservation etc 
which provide the nucleus of reasonable models and to 
indicate outstanding areas of uncertainty. 

One of the main problems arises as a result of the 
complexity of the overall situation. In order to restrict 
the number and type of variables which could interfere 
with both experimental examination and mathematical 
modelling of dispersion, one has almost invariably 
considered only flat open and uniform terrain, yet in 



the real world this so seldom applies. However it is 
both necessary and essentially practical to examine the 
mechanisms of turbulence and dispersion in the 
simplest situation possible initially. When they have 
been reasonably established, a situation which is fast 
approaching, the examination can be extended to some 
of the more important perturbations. The two which 
are expected to have the most frequent and dominant 
effect are those of ground slope (or terrain) and 
ground obstructions. 

Some of these effects are already quite well known, 
but generally only in a qualitative way, and there is 
still a need to obtain some quantitative data especially 
for those features where the effect can be significant. 
However it is known that heavy gas clouds do not 
when dense move uphill except with moderate or 
stronger winds, and they may even roll down a hill 
against slight winds. 

In considering what should be the future objectives in 
this field of research, it is necessary to look closely at 
the data available from past accidents. Although some 
of it is sparse and potentially useful information may 
be non-existent, there are some incidents recorded, 
either in reports or through the camera, where vital 
information can be obtained. One of the most critical 
areas is in establishing how a release of hazardous 
material occurs, and how it forms a gas cloud in close 
proximity to the point of escape, usually before the 
wind carries it away. It is now well established that the 
mechanism of release can have a significant effect on 
the subsequent dispersion of the cloud. For instance 
the mechanism can dictate whether a large release of 
ammonia forms a low lying dense cloud, or a more 
normal cloud which may lift off. The variety of 
potential mechanisms is large, but there is a real need 
to understand these much better than can be done at 
present, to the extent that some limited research could 
be justified. 

The second area, already referred to, is that of the 
effects of terrain and topography. Although every 
situation presents a different set of circumstances, 
there is currently little guidance available to indicate 
how and to what extent these effects can improve or 
inhibit the normal dispersion processes in the free 
flowing atmosphere. It is considered desirable to 
support some research on these effects, to the point at 
which adequate guidance can be obtained for a 
reasonable cost. To go any further would command 
disproportionate resources and the information would 
be applicable to a limited number of circumstances in 
a very few locations. 

The cost of the recent full scale experiments at 
Thorney Island, China Lake and Maplin Sands is 
enormous, and cannot be further justified unless 
shown to be essential. This requires the objective to be 
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clear, and cheaper alternative methods shown to be 
unsuitable. At the present time, the use of wind 
tunnels is seen as a very cost effective method of 
examining a wide variety of situations quickly and at 
moderate cost, and is to be recommended as the 
preferred method of continuing this research. It will 
also be essential to use the full-scale experimental data 
obtained in recent tests to check the scaling laws for 
these wind tunnels, an aspect of some uncertainty at 



the present time. This work has already started, and 
should be encouraged. 

Only after this stage in research, using wind tunnels, 
should any consideration be given to the ppssibility of 
further full-scale tests. It will be desirable for any such 
tests to be mounted on an international scale, without 
duplication of effort, and the Committee note with 
satisfaction the moves in the USA towards this end. 
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Appendix 7 Research on unconfi led vapour 
cloud explosions 

(by Dr H Phillips — HSE) 



Research on unconfined vapour cloud explosions 
(UVCEs) is proceeding throughout the world and 
many other groups are concerned with topics of a 
general combustion nature which have a bearing on 
certain aspects of UVCE behaviour. Of direct interest 
are the works on blast generation, blast effects on 
structures and the characterisation of the hazard 
potential of the flammable materials that might be 
involved. Ancilliary work of importance includes that 
on flame propagation (deflagration and detonation) 
through gases and aerosols and that on ignition 
processes. 

Current research 

Research has been aimed at an understanding of 
UVCE’s to improve the analysis of accidents and to 
enable the prediction of the nature and effects of such 
explosions in a wide range of industrial environments. 

To this end research of direct concern can be classified 
as follows: 

(a) experimental simulation of unconfined 
explosions; 

(b) computer simulation of unconfined explosions; 

(c) mechanisms for increasing flame speed and blast 
over-pressure; 

(d) effect of blast on structures, and 

(e) classification of flammable gases and vapours 
according to their degree of hazard. 

(a) A few organisations have undertaken 
experimental simulations of unconfined 
explosion. A feature of all the experiments is that 
in the absence of turbulence promoters the 
measured over-pressures have been insignificant, 
frequently being too low to measure. With 
turbulence promoters somewhat higher over- 
pressures have been recorded but still not 
sufficiently high to explain accidental blast 
damage. Higher pressures have been obtained but 
only with reactive gases, such as acetylene and 
with violent initiation by an explosive charge. 

(b) Many computer simulations of unconfined 
explosions have been undertaken and work is 
continuing. The typical approach is to assume a 
flame speed or burning velocity and to compute 
the blast over-pressure generated. To obtain 1 
bar over-pressure within the flame, required to 
explain the far field damage (see Second Report 
(1979)) requires a flame speed of over 300 m/s 
corresponding to a burning velocity of over 40 
m/s. It is only with extreme difficulty that such 
high burning velocity can be achieved in the 



laboratory and it is unlikely that turbulence can 
augment burning velocity so much in an 
unconfined explosion. The Second Report 
suggests a maximum over-pressure of 1 bar, 
which is sufficient to explain the damage to many 
of the structures at Flixborough. However within 
the explosion there was evidence of higher 
pressure. Gugan (1979) suggested up to 20 bar 
but this is now believed to be an over-estimate. 
Phillips (1981) re-examined the data and 
considered 6 to 7 bar to be more realistic. Such 
over-pressure requires a very high burning 
velocity and to incorporate these into the 
computation demands adjustment to the 
algorithm to over-come numerical instability. 

(c) High over-pressure can be predicted by 

computation with the assumption that burned 
and unburned gases move at different velocities 
within a thick burning zone — Phillips (1982). 
Under certain conditions, such as exceeding a 
certain volumetric heat release rate and with a 
suitable initiation, this leads to flame 
acceleration, with the final speed depending on 
the reactivity of the fuel and the size of the 
cloud. High over-pressure, 6 bar or more, is 
predicted. The results of computation suggest 
that experimental verification would require a 
vapour cloud much larger than has been used to 
date. Other means for augmenting burning 
velocity in an unconfined explosion have been 
suggested. Bray and Moss (1981) recognise that 
the burned and unburned gas move at different 
speeds and they surmise that turbulence is 
generated at the interface, leading to an increase 
in heat release rate and in some circumstances to 
flame acceleration. Moore and Weinberg (1981) 
suggest that thermal radiation ahead of the flame 
can heat small particles, such as particles of 
thermal insulation material, to provide new 
centres of ignition ahead of the main flame. Only 
a few such centres are required to give significant 
increase in blast over-pressure. 

(d) Work on the effect of blast on structures is in its 
infancy. Much data is available on the effects of 
blast from military explosives, but the blast from 
the unconfined vapour cloud explosion has a 
more gradual pressure rise and a longer duration 
Studies are in progress to compute the pressure 
loading on structures of complex shape. 
Experiments have started within the HSE on the 
reaction of simple structures to explosion blast 
with emphasis on aspects of the strength of 
materials. 
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(e) A classification of flammable gases and vapours 
according to their degree of hazard was made on 
an intuitive basis by T.N.O. in the Netherlands 
for the preparation of the Dutch Yellow Book. A 
system of classification based on the critical tube 
diameter required to initiate spherical detonation 
has been suggested (Lee, 1981). The critical 
initiation energy for spherical detonation has also 
been explored (Bull et al, 1977). 

Future trends 

Much of the earlier work fails to explain the damage 
caused in accidents, but points out deficiencies in the 
classical approach to the study of flames and 
explosion. It is only in the last few years that the 
difficulties are being surmounted. There is now a 
prospect of being able to explain or predict the course 
of a vapour cloud explosion. 

Present work is concentrated in three broad areas: 

(a) understanding of flame acceleration, 

(b) simulations of non-spherical explosions and 

(c) blast loading on structures. 

(a) Further work is required to understand the 

acceleration of flame to the high speeds needed 
to give realistic blast damage, and the effects of 
the early stages of the explosion on its 
subsequent acceleration. Further experimental 
studies are planned but a computer simulation 
seems to offer the best approach in the 
immediate future. 



(b) The simulation of non-spherical explosions is still 
in early stages. Simple rules for evaluating blast 
are available but more rigorous treatments are 
planned. Rigorous computer solutions of the flow 
equations in two and three dimensions are likely 
to be large and expensive and future work will 
centre on procedures for simplification. 

(c) Computation to predict blast-loadings on 
structures can be made in two dimensions and 
work is planned to enable predictions to be made 
of the interaction of a blast wave with a three- 
dimensional structure. 
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A spendix 8 Catastrophic fires 

(All papers included in this Appendix are by the Advisory Committee on Major Hazards — Working Group E) 



In the context of major hazards installations a 
catastrophic fire is distinguished by the area likely to 
be affected, intensity, the speed of development, 
location or a combination of these factors. 

We are concerned with potential incidents having 
serious consequences in terms of damage to the 
population and the environment, such as 
conflagrations, fire balls and fire storms, all of which 
come within the definition of a catastrophic fire. These 
fires are conceived as being outside the range of 
severity of industrial fires most usually encountered. 

Conflagrations involving industrial cellulose nitrate 
(nitrocellulose) 

The Explosives Act 1875 applies to guncotton which is 
the name given to nitrated cellulose, usually cotton, 
made into solid propellants for ammunition, rocket 
motors and into commercial and military explosives. 
Less highly nitrated grades of cellulose nitrate are used 
for industrial purposes and these are exempt from the 
controls of the Explosives Act provided that not less 
than 85% of the material is soluble in ether and 
alcohol, it contains less than 12.3% nitrogen and is 
uniformly mixed with not less than one third of its 
weight of certain liquids, or is in solution, or is 
gelatinised with not less than 18% of a plasticiser. 

These measures confer some stability on the inherently 
unstable substance to render it safer to store and 
handle. Because of its ability to form strong cohesive 
films, industrial cellulose nitrate is mainly used in the 
paint and printing ink industries. Some celluloid is still 
produced and there are relatively large stocks of 
cellulose nitrate based cinema films held in the special 
stores of film archives. 

Industrial cellulose nitrate does not need air for 
combustion, the nitrate groups within the molecule 
supply sufficient oxygen. In the dry state it is easily 
ignited by a flame, sparks, impact or friction. It burns 
extremely rapidly with a very hot flame and if ignited 
in a confined space will generate gas pressure with 
explosive violence. Self-sustaining decomposition can 
occur. The gases produced by decomposition are both 
flammable and toxic, and can explode if mixed with 
the requisite amount of air and the mixture ignited in 
a confined space. 

Industrial cellulose nitrate is packed by the makers 
into steel or fibre-board drums and is dampened with 
water or with isopropyl or butyl alcohol or is 
plasticised. The kind and the amount of dampening 
material considerably influences the rate of burning. If 
the protection of the dampening medium is lost due to 
physical damage to the drums or because the 
dampening medium migrates, the cellulose nitrate will 
dry out and then the hazards are greatly increased. 
Spilled dampened material can dry out and be ignited 



by friction, for example. The use of flammable liquids 
as dampening media introduces the additional 
potential hazard of the flammability of the vapours. 
Alcohol dampened material is usually packed in a 
polythene liner within the drum whereas plasticised 
material is not packed in polythene because of 
electrostatic hazard. The fastenings of the drum lids 
are designed to relieve internal pressures in excess of 3 
bars. 

Tests have shown marked differences in behaviour in 
fire of alcohol dampened industrial cellulose nitrate 
depending whether it is packed into steel or fibre- 
board drums. In fire the contents of the steel drums 
were ejected and burned extremely rapidly with 
fireball-like behaviour and a burning time of 1 to 2 
minutes. In contrast, the same material in a fibre- 
board drum burned relatively quietly for about 30 
minutes. The plasticised material behaved similarly in 
fire whether packed in steel or fibre-board drums. It 
burned very vigorously but without the fireball-like 
behaviour exhibited by the alcohol-wet material. 

In 1973 almost 400 te of alcohol-wet cellulose nitrate 
packed in steel drums and stored in the open air 
caught fire. Scorching and blistering to wooden 
structures was experienced at distances up to 140m but 
it is possible that some of this damage was caused by 
radiation from secondary fires. 

Fireballs 

The Second Report of the Advisory Committee on 
Major Hazards drew attention to the dangers 
associated with fireballs and suggested that further 
study of this phenomenon was desirable. Since then a 
number of papers have appeared describing the results 
of theoretical and practical investigations and 
reviewing the available literature. (1-9) 

It is useful, at this point, to describe the catalogue of 
possible events which could follow the sudden failure 
of a pressurised container holding flammable material. 
When a flammable gas or vaporising liquid escapes 
from a vessel under pressure it mixes progressively 
with the air as it moves away from the sources of 
escape. Should it be ignited, what happens will depend 
upon the stage in the mixing process at which ignition 
takes place. 

If the source of ignition is remote from the source of 
escape, mixing will have progressed and it is an 
explosive cloud that is ignited. Burning proceeds 
quickly through the mixture of fuel and air. If the 
mixed cloud involves tonnes of flammable material an 
unconfined explosion may occur, accompanied by 
significant pressure effects. If the cloud is small, 
burning occurs smoothly, although rapidly, and the 
result may be described as a flash fire or burning 
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vapour cloud. In any event, to be engulfed in the 
resulting flame is likely to prove fatal. 

If on the other hand the issuing flammable material is 
ignited near to its source of escape, burning and 
mixing progress together. Should the rate of discharge 
of fuel be rapid, the flame becomes turbulent and 
intense and ‘lift off from the source of escape may 
occur, resulting in a mushroom-like formation. This is 
known as a fireball. 

In the past, there have been a number of fireballs 
immediately following a BLEVE (boiling liquid, 
expanding vapour explosion) when this has resulted 
from the engulfment in fire of a vessel containing 
flammable vaporising liquid (such as LPG). As a fire 
is already present, early ignition of the material 
emerging from the bursting vessel is assured. 

It appears from the review papers cited that there is 
general agreement on the size of a fireball from a 
given release of fuel, but a fairly wide variation in 
opinion concerning the effective duration and the 
surface emissive power. It seems likely, however, that 
both these parameters could be influenced by the 
nature of the release and the mass of material released. 
For the purposes of calculating levels of thermal 
radiation, most workers assume spherical geometry 
and it can be demonstrated that this assumption is 
reasonably valid for distances of significance in the 
study of major hazards. 

At present it is possible to calculate levels of thermal 
radiation based on parameters derived from small 
scale experiments and empirical calculations. To 
improve or validate these conclusions, larger scale 
experiments are required to relate rate of growth, 
effective duration and surface emissive power to the 
pressure and mass of the material released. Work is 
also necessary to establish the relationship between 
atmospheric attenuation of thermal radiation over a 
range of atmospheric conditions and flame 
temperatures or surface emissive powers. There is a 
considerable need for research in the field of the 
effects of thermal radiation on people. 

Fire storms 

We have noted that there is considerable literature on 
fire storms but that the discussion has scarcely, if at 
all, involved specialists in the fields of major chemical 
hazards. The discussion has been concerned in the 
main with problems of civil defence or with forest 
fires. 

Such an event involves the firing of a high proportion 
of buildings over a large area within a short space of 



time. As a result of the convective currents the 
draughting of the fire is enhanced, giving rise to high 
temperatures and high peripheral winds, sometimes of 
hurricane force. Some of the most serious fire storms 
in history occurred during World War II, initiated by 
heavy bombing raids on German and Japanese cities. 
The death tolls in these fires were at least an order of 
magnitude greater than those associated with 
conventional bombing. The Group concludes that the 
fire storm phenomenon is real, and believes that it 
may also have occurred in peace time during city fires. 

In wartime, fire storms were associated with the 
dropping of high explosive bombs which shattered 
buildings and hampered the work of fire fighters, 
alternating with the dropping of incendiary bombs. 
Certain German cities were vulnerable to the 
establishment of fire storms because multiple ignitions 
occurred within a short time (up to, say, two or three 
hours) in areas of high density of buildings with 
narrow streets. 

The Group note that there are many and considerable 
differences between conditions affecting the initiation 
and response to wartime and peace time events of a 
fire storm nature. 

We consider that the layout of modern chemical and 
process plant is unlikely to provide the conditions 
necessary for a fire storm and to affect populated 
areas solely as a result of conventional fire spread. 

We however consider that there are some grounds for 
believing that a fire storm in a surrounding urban area 
could be initiated by a spillage of a few hundred 
tonnes of liquid oxygen. We recommend therefore 
detailed study of the fire storm potential of liquid 
oxygen spillages. 
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Appendix 9 Dust explo ion 

(by the Advisory Committee on Major Hazards Working G p H ) 



The question which Group E addressed was: Are 
there installations in the UK which have major hazar 
potential through the medium ot dust explosions? 

What follows is a summary of the Group’s 
deliberations in an attempt to answer the question. 

The underground workings of coal mines are excluded 
in what follows because these have been subject to 
close enquiry by other agencies, and present no hazard 
to the general public. 

Dust explosions have usually, but not exclusively, 
taken place in premises processing grain into animal or 
human foodstuffs. The tatalities are usually the result 
of the collapse of buildings or structures, and to this 
extent the effects are localised. Materials which present 
a risk of a dust explosion are, however, to be found in 
a wide range of industries. It is generally considered 
that the potential hazard exists in the circumstances of 
the production of sugar, starch and flour where large 
quantities of flammable dusts are processed in tall or 
multi-storied structures of heavy construction. 

Premises in which large quantities ot aluminium or 
magnesium powder are processed are a matter ot 
particular concern, as these materials have in the past 
produced explosions of exceptional severity. The 
incidents involving dusts or powders usually have 
effects which could be termed local and have theretore 
been excluded from the provisions of the proposed 
notification regulations. 

Some incidents 

There have been few major incidents involving 
flammable dusts in the UK. A summary of these 
accidents is given in Table 1 below. Excepting two of 
the 1911 incidents all those killed were workpeople on 
the premises. 



Table 1 Major UK dust explosions 



Year 


Location 


Within 

Killed 


premises 

Injured* 


Outside premises 
Killed Injured * 


1911 


Glasgow 


2 


3 


3 


5 


1911 


Liverpool 


37 


100 


2 


1 


1911 


Manchester 


3 


5 


- 


- 


1913 


Manchester 


3 


5 


- 


- 


1930 


Liverpool 


11 


32 


- 


- 


1941 


Liverpool 


6 


40 


- 


- 


1964 


Paisley 


5 


2 


- 


- 


1965 


London 


5 


32 


- 


- 



* Definition of injury In the period from 1906 until 1937 it was 
mandatory to report to the District Inspector of Factories any 
accident of sufficient severity to disable an employee from working 
at his ordinary work for more than seven days. In 1937 the 
qualifying period was reduced from seven to three days. 
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For comparison with the figures reported in Table 1, 

15 were killed and 599 injured in the 18 year period 
1962-1979 in 1176 relatively minor incidents reported 
as involving flammable dusts, 474 being explosions 
and the remainder were fires. The ratio ot killed to 
injured in these incidents is low. For example, in the 
UK in this period 25 persons were killed, 10 of them 
in 2 incidents, and there were 633 people injured in all. 

Similar major explosions have occurred overseas. For 
example in 1919 at a starch/corn plant at Cedar 
Rapids USA, 43 persons were killed, and in 1942 at a 
similar plant in Peking, Illinois, USA, 42 persons were 
killed. More recent US grain elevator explosion 
statistics are given in Table 2. 



Table 2 Recent explosions in US grain handling facilities 



Year 


Killed 


Injured 


Number of explosions 


1974 


7 


47 


12 


1975 


65 


84 


21 


1976 


22 


82 


27 


1977 


4 


19 


9 


1978 


13 


37 


15 



Two incidents in the USA, one in 1917, and another in 
1929, each resulted in 8 fatalities from explosions 
involving metal powder dust clouds. 

World wide experience indicates that to be injured by 
a dust explosion one has to be close to the affected 
premises; dust explosions tend to destroy the often 
large buildings containing the plant but their effects 
are localised. This is reflected by the comparatively 
low incidence of off-site casualties as shown in Table 1. 

Industrial processes involving flammable dusts can be 
divided into those in which dusts: 

(a) are an integral part of the manufacture, such as 
the fine dust produced by grinding, or 

(b) arise as a by-product of processing. 

Unlike explosive gas mixtures, the partial volume of 
dust required for an explosion is very small. For a 
number of reasons the explosives range for dusts is 
much wider than for vapours. It is dust particles 
smaller than 200 microns which result in potentially 
hazardous conditions. The smaller the particle, 
generally, the greater the danger. Confinement volume 
and geometry are significant parameters in dust 
explosions, as is the exposed dust surface area. The 
dusts from wheat, soya and maize, which have 
produced big damaging explosions, are easier to ignite 
than coal dust. 

The true potential for a dust explosion resulting from 
an industrial process lies in the volume of the dust 
cloud that exists in confined conditions. The design 
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capacity of a silo for stored material (viz sugar) gives a 
rough guide to the potential for explosion, but a 
nearly empty silo, for the reasons given above, gives 
rise to a much more hazadous situation than one 
which is nearly full. It is not only in the interior of 
silos that the hazard of explosion arises. Fine dust 
which escapes from plant can settle in the surrounding 
building enclosure and any substantial accumulations 
within a building, sufficient to create a flammable 
cloud on resuspension, can cause an explosion severe 
enough to destroy the building. Thus a relatively 
minor explosion may create a much more serious 
incident by resuspending and igniting the accumulated 
flammable dust in air. The demolition of the building 
containing the plant causes many of the casualties. 
Thus, good housekeeping is vital in buildings 
containing the plant handling flammable dust. 

Though a number of major explosions in the USA 
during 1977-78 focussed considerable attention on 
grain silos, we consider that conditions in the UK 
differ widely from those in the USA. UK grain silos 
are smaller in size and number than those in the USA. 
Also, the intermittent nature of UK operations does 
not put maintenance under pressure, as in the USA. 
The maintenance aspect is considered most important 
for good explosion prevention. International 
collaborative work is at present investigating the 
pressure rise developed during silo explosions with a 
view to providing guidance as to the venting 
requirements of large silos. 

The possibility that hazards may arise in the future 
because of increases in the production and 
transportation of pulverised coal is recognised. This 
fuel type is beginning to be used on a world-wide 
scale. The UK may become a distribution point for 
such fuel, which could be of concern if it became a 
megatonne per annum trade. 

The Group recognise that best current practice 
comprises: 

(a) the elimination of the hazard (eg by the use of 
water slurries), 

(b) planned explosion protection (eg the 
incorporation of adequate explosion relief vents 
on plant, the use of automatic explosion 
suppression systems, inerting the atmosphere, or 
by making the plant strong enough to resist any 
internal explosion), and 

(c) eliminating the risk of serious secondary 
explosion by siting plant in the open air. Where 
this would not be practicable the plant should be 
contained within lightly sheeted, strongly framed 
buildings, or the buildings themselves should be 
provided with adequate explosion relief. 

Our conclusions are: 

(a) We consider that the potential for dust explosion 
incidents exists quite widely in the UK and that, 
judging from the records of incidents and 
casualties, the hazards are being well controlled 



by means of Section 31 of the Factories Act 1961 
(see Annex 1). However, vigilance must not be 
relaxed nor opportunities to effect improvements 
be neglected. 

(b) The conditions relating to UK grain silos are 
such that silo explosions of the frequency and 
type experienced in the USA during recent years 
are most unlikely in the UK. 

(c) We call attention to the best current practices 
outlined above. 

(d) We call attention to the services offered for the 
determination of dust explosibility described in 
Annex 2. Advice on precautions may be obtained 
from the Fire Research Station or from the lpcal 
office of the Health and Safety Executive. 



Annex I Extract from Factories Act 1961 Part II 

Section 31 

(1) Where, in connection with any grinding, sieving, 
or other process giving rise to dust, there may escape 
dust of such a character and to such an extent as to be 
liable to explode on ignition, all practicable steps shall 
be taken to prevent such an explosion by enclosure of 
the plant used in the process, and by removal or 
prevention of accumulation of any dust that may 
escape in spite of the enclosure, and by exclusion or 
effective enclosure of possible sources of ignition. 

(2) Where there is present in any plant used in any 
such process as aforesaid dust of such a character and 
of such an extent as to be liable to explode on 
ignition, then, unless the plant is so constructed as to 
withstand the pressure likely to be produced by any 
such explosion, all practicable steps shall be taken to 
restrict the spread and effects of such an explosion by 
the provision, in connection with the plant, of chokes, 
baffles and vents, or other equally effective appliances. 

(4) No plant, tank or vessel which contains or has 
contained any explosive or inflammable substance 
shall be subjected — 

(a) to any welding, brazing or soldering operation; 

(b) to any cutting operation which involves the 
application of heat; or 

(c) to any operation involving the application of heat 
for the purpose of taking part or removing the 
plant, tank or vessel or any part of it; 

until all practicable steps have been taken to remove 
the substance and any fumes arising from it, or to 
render them non-explosive or non-inflammable; and if 
any plant, tank or vessel has been subjected to any 
such operation, no explosive or inflammable substance 
shall be allowed to enter the plant, tank or vessel until 
the metal has cooled sufficiently to prevent any risk of 
igniting the substance. 
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Annex 2 Dust explosibility assessment 

Tests are available at the Fire Research Station tor the 
assessment of a range oi dust explosibility parameters. 
These include classification tests and measurement o 
maximum explosion pressure, minimum ignition 
temperature, minimum ignition energy and minimum 
explosible concentration. Tests are commissioned on a 
sponsored basis and the methods used have been 
agreed with HM Factory Inspectorate. 

By means of this service, industrial and official 



enquirers are able to have samples of dusts and 
powders assessed accordingly to officially published 
methods. Manufacturers of powders use the service in 
meeting their requirements under the HSW Act. 

In addition to explosibility assessment, the Fire 
Research Station also carries out research into the 
validity of proposed changes to test methods and also 
on the methods of protection against dust explosion. 

Testing and information services are also available 
from specialist commercial undertakings and the 
appropriate departments of certain universities. 
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A] ipendix 1( Domino effect 



Working Group E) 



(by the Advisory Committee on Major Hazards — 

The domino or ‘knock-on’ effect refers to a loss of 
containment incident which interferes with the 
operation of other adjacent plant so that further loss 
of containment occurs. This hazard was identified in 
our First Report (para 13). We have reviewed available 
material and conclude that the circumstances 
surrounding such postulated events require 
examination on an individual basis. 

For example, a small leak of flammable gas may ignite 
and the flame impinge on a large vessel, leading to a 
large spill of hazardous substance. Protective systems 
may be destroyed by flame impingement and missiles 
from disrupting machinery may breach containment. 
Ship accidents in port areas or coastal waters close to 
land may adversely affect operations on ships in 
neighbouring berths or operation of plant on land. 

These effects were demonstrated in an accident in the 
harbour at Texas City in 1947. The cargo of 
ammonium nitrate on the SS Grandcamp exploded, 
causing a tidal wave 5m high which flooded the nearby 
Monsanto Chemical Company. In addition, burning 
debris from the SS Grandcamp started a fire on the SS 
High Flyer, berthed 214m away. The cargo of the SS 



High Flyer included both sulphur and ammonium 
nitrate and subsequently exploded, destroying the ship. 

Accidents on one industrial site can affect operations 
on nearby industrial sites. An example of this effect 
was provided by the Flixborough disaster in 1974 
when the explosion on the Nypro site caused a loss of 
cooling water to blast furnaces at a nearby British 
Steel plant. 

We are of the opinion that it should be standard 
practice that everyone operating plant where a major 
accident could occur should consider the effects of 
such events on other plants on their site or a nearby 
site and that all those affected should plan accordingly 
to minimise the consequences. The provisions of the 
EC Directive on Major Hazards of Certain Industrial 
Activities require manufacturers to notify competent 
national authorities of all aspects of such activities. 

The activities must also be examined for domino 
effects. 

We feel that the methodology used in the process 
industry should be used in such hazard reviews. Such 
analyses were used in the Canvey Island investigations. 
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Appendix 11 The siting of deve op nr er ts in the 
vicinities of major hazards: HSE’s draft 
guidelines t< banning r horities 

(by the Health and Safety Executive — Major Hazards Assessment Unit) 



Introduction 

The control of risks from major hazards may be 
achieved in various ways, for example: 

(a) limit the amount of hazardous material present; 

(b) reduce the likelihood of an accidental release ot 
material; 

(c) plan for emergencies, and 

(d) reduce the number of people exposed to risk. 

Some of these measures may be taken within the 
installation, particularly at the project planning stage. 

In many cases the situation in the installations is 
already fixed and the scope for improvement under 
HSW Act is fully utilised. Even so, there may remain 
some residual risk. It may still be desirable to control 
the number of people exposed to that risk. It is 
unlikely that the residual risk could justify the removal 
of existing populations by the termination oi viable 
ldnd uses. However, it is possible to inhibit an increase 
in the population at risk by control of new 
developments under planning legislation. 

It is the purpose of HSE’s advice to facilitate planning 
control where appropriate. Planning authorities are 
expected to include the factor of risk in their 
consideration of a planning decision. Thus the types of 
development near major hazards should be deliberately 
chosen to minimise the population at risk. 

HSE takes as a starting point the assumption that the 
major hazard installation complies with the 
requirements of HSW Act. It is then necessary to 
assess the level of residual risk to a proposed 
development in the vicinity, and to judge whether this 
might be a significant factor in the planning decision. 
HSE’s assessment takes account of the consequences 
and likelihoods of various accident scenarios, and the 
implications of variations in vulnerability between 
different types of development. In some cases the 
assumption of compliance with HSW Act implies a 
precise standard. 

In other cases the standards are not precisely defined, 
or it may be possible to comply in a variety ot ways. 
The individual characteristics of installations are taken 
into account where possible, but there are limits to the 
amount of detail which can be considered. It may be 
necessary to assume average performance in the 
absence of obvious individual variations, or for cases 
which are being assessed on paper. 
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This note deals only with the provision of advice on 
proposals for new developments in the vicinity of 
existing major hazards. The assessment techniques are 
used in a similar way when considering the siting of 
new major hazards in relation to existing buildings, 
but the judgement of the significance of the risks may 
be different. For example, the siting of a new major 
hazard may be constrained by the need to integrate it 
with existing plant. The application of a simple 
‘reciprocal rule’ for the siting of new major hazards 
would neglect the differences in availability of sites for 
the two situations. There is also the possibility of 
seeking special safety standards on a new plant to 
facilitate its siting. 

Assessment: likelihood and consequences of an accident 

The first part of the assessment is objective in the 
sense that it does not include social or political 
judgements, but it does include estimates of various 
factors where data is more or less unavailable. Thus it 
includes technical judgement by professional risk 
assessors. There is inevitably some uncertainty 
introduced by this judgement process and by lack of 
precision in basic data. This does not prevent the 
derivation of reasonable conclusions but it does imply 
that some caution is necessary. The technical 
judgements may tend to lead to an over-estimate of 
the risk level. If a planning decision is finely balanced, 
a more detailed review of assumptions may be 
worthwhile. 

Assessments of risk from different materials differ in 
detail but they have many features in common. The 
basic sequences of events for LPG and chlorine are: 

LPG: Plant failure — release — vaporisation — mixture 
with air — ignition — explosion and/or fire — blast 
and/or heat propagation — impact (either directly on 
people, or on buildings which collapse or burn). 

Chlorine: Plant failure — release — vaporisation — 
mixture with air — travel downwind — dilution — 
inhalation — injury. 

The risks from such sequences can be evaluated in two 
main ways, namely historical and analytical. In the 
historical approach, information from past incidents is 
used to predict the risks. The Second Report ot the 
Advisory Committee contains information on some 
past incidents, and it derives a “Mortality Index” to 
indicate the average number of fatalities per tonne ot 
material released. This approach may be useful to 
devise a hazard rating for a material, but it is 
noticeable that the average index conceals a wide 
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variation between cases and it is thus of questionable 
value for predicting individual situations. Other 
problems with the historical approach are the small 
number of cases and the incompleteness of 
information on cases, so it may therefore provide a 
rather poor statistical basis. This approach might be 
difficult to adapt for prediction in situations different 
from those already included by the accidents. 

The alternative, analytical, approach attempts to 
synthesise the risk on the basis of sequences outlined 
above. This approach is complex and it requires 
assumptions to be made in the absence of data. Also, 
it may be difficult to select appropriate scenarios to 
include. It is of course possible to combine the 
approaches, and in practice this is what is done. The 
historical approach is used to provide information on 
the likelihoods of releases, while the analytical 
approach is used to predict consequences. 

To illustrate the approach, the example of bulk 
pressurised LPG is used. Installations of this type 
comprise the majority of the major hazards in Britain, 
and the risks from them are relatively straightforward 
to assess. The assessment might begin by listing the 
various possible releases, either by quantity (short 
release e.g. tank burst) or by rate (long release e.g. 
uncontrolled pipe-split). There is a continuous range of 
possible release, but this can usually be simplified by 
identifying obvious sub-divisions. For the LPG case 
we might have: 



Event 


Probability 


Consequences 


Minor flange or 
gland weeping 


Quite likely 


Not felt off-site 


Pipework break 


Rather unlikely 
especially for major 
cases 


Localised, but could 
extend off-site from 
major cases 


Tank burst: 
BLEVE 


Very unlikely 


May be harmful at 
considerable distances 
off-site 


Tank burst: 
UVCE (delayed 
ignition) 


Extremely unlikely 


1* 


Tank burst: drifting 
gas clouds 


Extremely unlikely 


11 



It is now necessary to determine more precisely what 
are the probabilities and consequence of these events. 
Obviously there could be wide variations between 
individual plants and between events in each sub- 
division. For example, the effects from pipe-break 
might depend on: size of hole; duration before shut- 
off; whether liquid gaseous or two-phase; wind-speed; 
delay before ignition; dispersion to below flammable 
limits; type of combustion, and site-specific features. 

To simplify the problem, assumption^ are made to give 
an indication of the realistic outcome from the most 
severe event within a sub-division. 

The consequences in terms of likelihood of injury are 
derived by firstly calculating the impact intensity of 
the heat or blast at a particular distance, then relating 



this to the vulnerability of the population at that 
distance. The possibility is noted that different types of 
building, having different populations, might give 
different degrees of protection from any given 
intensity. 

The result of this process is a list of events and risks. 

A decision can then be made on which events are 
trivial in that no injury could result. For remaining 
events, the consequences are considered in conjunction 
with the likelihood, to determine the combined risk of 
release and injury. This completes the objective 
assessment. 

It should be noted that this approach does not 
automatically rule out from consideration any type of 
source event, however unlikely. Even the largest, most 
unlikely events are included, so there is not necessarily 
any cut-off corresponding to a “maximum credible 
accident”. However, attention is paid to the combined 
risks, which may be very small from an unlikely event, 
so that the largest events are not necessarily significant 
determinants of the overall risk. In practice, 
assessments may be based on one or two events which 
may thus appear to correspond to “maximum credible 
accidents”; this implies that lesser events ma^ be more 
damaging but they are so unlikely as to present 
negligible extra risk. For the LPG example, separation 
distance guidelines for the siting of the first category 
of development near existing installations tend to be 
based on the provision of substantial protection from 
BLEVE and UVCE; this automatically gives a very 
high degree of protection from pipe-break and lesser 
events. 

Assessment: types of development 

It was indicated earlier that different types of building 
may have associated with them populations whose 
vulnerabilities differ. This may be of great importance 
in a siting judgement. HSE feels that it would be 
inappropriate to advise against all forms of new 
development near major hazards nor need new jnajor 
hazards be sited away from all existing buildings. 

Types of developments may be distinguished by 
various factors which relate to the risks, for example: 

(a) whether residential, workplace, recreational, 
shopping etc; 

(b) length of time any individual may be present; 

(c) number of people who may be present and duration 
of occupancy; 

(d) ease of evacuation; 

(e) inherent vulnerability of people e.g. elderly, 
disabled, children, and 

(f) physical factors e.g, building height, materials of 
construction etc. 

On the basis of these factors, HSE identifies three 
main categories of development. The first consists of 
developments where users would be present for most 
of the time, or where large numbers could be present 
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at any one time, or where people are particularly 
vulnerable. Examples include housing, shopping 
centres or very large retail outlets, multi-storey office 
blocks etc. The second category consists of less 
sensitive developments and includes industrial 
developments with low employment density, 
warehouses etc. HSE also identifies a third category 
containing special cases such as hospitals, schools and 
other particularly vulnerable developments, to which 
particular attention should be paid in siting 
judgements. 

It is normally advised that planning control is only 
necessary in respect of the first and third categories of 
developments near major hazard installations. There 
are various mitigating factors associated with the 
second category, such that it would be difficult to 
argue that the risks to users justify inhibition of this 
type of land-use. These factors could include ease of 
evacuation, low occupancy-time, fitness of population 
(e.g. adult workforce), small number of people, building 
protection or building not hazardous to occupants, etc. 

Summary of MHAU’s advice 

For LPG and similar flammable liquefied gases, HSE 
recommends separation distance limits such that the 
consequences of minor releases at the limit would not 
be injurious, while the consequences of major releases 
(BLEVE, UVCE) would be unlikely to seriously injure 
more than a small fraction of the exposed population. 
In principle, unignited vapour clouds could travel to 
the limit, or even beyond it in unfavourable weather 
conditions, and people enveloped in a cloud would 
probably be seriously injured, but the risk to an 
individual from such a scenario is very low. 

For chlorine, HSE recommends separation distance 
limits such that the consequences of major pipework 
failures would be unlikely to seriously injure more 
than a small fraction of the population downwind, in 
typical prevailing weather conditions. In unfavourable 
weather, or with larger releases from tank failure, 



people at greater distances could be injured, but the 
risk to an individual from such a scenario is very low. 

Presentation of advice 

In presenting its advice, HSE attempts to give 
planning authorities clear guidance on the weight to be 
attached to the factor of safety. HSE tends to use one 
of three graded responses as follows: 

Situation 1 (negligible risk): No significant reasons 
for refusing planning permission. 

Situation 2 (marginal risk): The risks are very small 
and are hot in themselves sufficient grounds for 
refusing planning permission, but they could be a 
factor against the development to add to any other 
adverse factors. This would apply near the outer 
limit of separation distance, or with small 
developments. 

Situation 3 (substantial risk): While the probability 
of a serious incident is low, the consequences at the 
proposed development site could be serious. The 
safety issue should be a major factor and the 
planning authority is advised not to grant planning 
permission. If there were other factors which 
weighed strongly in favour of the application, HSE 
would seek to explain the technical assessment and 
level of risk in more detail before the planning 
authority’s decision was made. (In exceptional cases 
of Situation 3, where the planning authority was 
minded to grant permission contrary to HSE’s 
advice, HSE might consider whether to request a 
planning inquiry where the issues could be examined 
in detail in a public forum.) 

It often happens that an initial unfavourable response 
from HSE leads to discussions of the scope for 
modifications to reduce the risk. Significant reduction 
may enable HSE to advise favourably. In other cases, 
HSE may give a conditional response, with advice on 
the use of planning conditions to ensure that the risk 
is reduced. 
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Aj pendix 12 Hardware reliability: incident 
reporting and assessed reliability 



(by Professor F P Lees) 

It is convenient to consider hardware and human 
reliability separately, but it is recognised that 
ultimately any failure in a man-made system may be 
regarded in a sense as a human failure. 

There are a number of aspects of hardware reliability 
on which research would be useful. First, there is need 
for a taxonomy, or perhaps better, a model of major 
accidents which can be used as a basis for the 
investigation of accidents and the collection of data. 
Second, guidelines based on this taxonomy or model 
are required for the reporting of accidents so that the 
information given indicates the significant features and 
thus provides useful data. Third, analyses of such 
reports are needed in order to give a better 
understanding of the particular types of failure which 
result in major accidents. Fourth, there are certain 
failure and event rates and probabilities which are 
critical in hazard assessments and on which better data 
are required. Fifth, a better understanding is needed of 
the current numerical limits of engineering feasibility 
and of the factors which determine these limits. Sixth, 
there needs to be more work done to demonstrate the 
validity of the hazard assessments which are made. 
These points are now considered in turn. 

There is a clear need for a system of classification of 
major accidents on hazardous installations. In many 
disciplines such a classification is based on a 
taxonomy. However, a taxonomy consists of a set of 
mutually exclusive categories, whereas an accident is 
usually the result of a combination of features, as the 
typical fault tree demonstrates. What is wanted, 
therefore, is an accident structure model which will 
probably resemble a fault tree in that it contains logic 
gates but which is general and hence applicable to all 
accidents. 

Some of the characteristics of major accidents which 
such a model would need to take into account may be 
illustrated as follows. In general, a hazardous release 
occurs only if there is an inventory of hazardous 
material, a failure of containment and failures of 
protection by hardware and by people. The failure 
may be one which occurs within the design parameters 
or outside them. It may be a mechanical failure, a 
process failure or a failure due to an external event or 
a rare phenomenon. Failure of protection by hardware 
may occur due to lack of, design defect in, disabling of 
or equipment failure in such protection. Failure of 
protection by people may occur due to failure of 
procedures or failure of initiative. Procedure failures 
include lack of, design defect in, neglect of and failure 
in execution of the procedure. Mechanical failures may 
be those of design, fabrication or installation and 



construction or those of inspection, maintenance and 
modification. Process failures may be those of normal 
operation, abnormal operation or liaison with 
mechanical functions. Some of these failures are events 
which initiate an accident sequence, others are events 
which negate mitigating features which normally 
prevent the sequence from propagating. Failures of 
inspection, of procedures and of protection by 
hardware and by people are particularly important 
categories of failure of mitigating features. 

Current practice in the investigation and reporting of 
major accidents leaves much to be desired. Reports are 
often incomplete and unbalanced and draw misleading 
conclusions. Given a suitable accident model it should 
be possible to devise guidelines for improved accident 
reporting. 

The implementation of such guidelines should result in 
a greatly improved data base for major accidents. One 
important use of the data base would be to obtain by 
statistical analysis a better understanding of causes of 
these accidents. Another important use would be to 
obtain data on certain failures and events which are 
critical in hazard assessment but which are currently 
subject to considerable uncertainty. 

A number of organisations are involved in the creation 
of data banks for accident reports, failure data, etc, 
relevant to major hazards and contact should be 
maintained with such work. There are also 
developments in computer technology which may also 
be relevant. These include not only keyword 
information retrieval systems but also expert systems. 

The question of the numerical limits of the reliability 
to which it is feasible to engineer plant is important. 
There are various limits given in the literature by 
engineers involved in quantitative assessment, but it 
would be useful if these could be clarified both with 
respect to the type of accident envisaged and to the 
features which limit the reliability attainable. The 
latter is certainly affected by features such as common 
cause failures but the relation between such features 
and reliability limits is unclear. 

There is now a considerable amount of activity in 
hazard assessment, but relatively little work has been 
done to validate the risk estimates which are made and 
there are many who remain sceptical. More needs to 
be done to validate the methodology. It is appreciated 
that the realisation of a major hazard is a rare event 
and that validation of the assessment up to this point 
is not practical, but it should be possible to do more 
to validate assessments of lesser events which are 
critical to the major accident. 
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Appendix 13 L uraa- reliability 

(by D C Thomas — HSE) 



The role of the human in the safety aspects of 
industrial systems is being realised and accepted more 
and more. However, the research and its subsequent 
application is still fragmented and narrowly applied to 
specific tasks and industries. There is no national 
programme for this work in the UK which attempts to 
coordinate the studies in human factors. If the UK 
intends to enhance the awareness of industry in the 
importance of human factors in safety and to 
encourage the application of relevant research, then 
some respected group should be established to act as a 
UK focal point for the whole area of human factor 
studies. At present, the Human Factors in Reliability 
Group and the Ergonomics Society are possible 
forums for reviewing, publicising and encouraging the 
application of human factors research efforts. 

Much effort has and is still being devoted to the 
operator and his control room environment and tends 
to be very specific in content. It is therefore necessary 
to broaden the areas of interest to those upon which 
the operator is dependent. These include plant 
inspection and maintenance, design and the whole area 
of management and organisational performance which 
pervades the activities previously mentioned. We feel 
that the performance of an individual is inseparable 
from the management/organisation performance. Any 
assessment should also be monitored through-out the 
life-cycle of both the plant and the organisation. 

As with any other type of assessment, there is a need 
to structure this subject area of study. There is still a 
lack of good models to facilitate the understanding, 
analysis and prediction of the whole area ot human 
and management performance. The behaviour of 
individuals and organisations is very complex and 
hence simple solutions, such as better ergonomics or 
more automation, do not necessarily provide the best 
answers. To assess the human factors aspect of safety 
some form of quantification is needed. This raises the 



problems of data acquisition (sources and techniques 
for obtaining data) and its validation. Objective data 
will be difficult to obtain; therefore research into the 
techniques for acquiring subjective data is probably 
the most fruitful area. Calibration/validation of 
models and data would require further studies. There 
is also a need to develop some agreed form of 
terminology and classification for this subject ie a 
taxonomy. There is still room for progress in this area. 

Once some structure has been achieved, it will be 
possible to identify, in a more refined and certain 
manner, the key human factor components which 
affect the safe operation of a system as well as their 
relative importance. 

All of this work will be only of academic value unless 
some effort and strategies are forthcoming to 
encourage industry to apply the findings of the 
research work. There is a significant need to forge 
research and development links between pure research 
and field application by industry. Possible 
reinforcement of these links could be via a UK forum 
or coordinating group, industry trade associations and 
Government advisory and regulatory bodies. 

Other areas of concern are the need to develop better 
aids for improving human performance such as 
training and documentation to support current 
ergonomic research. Due account should be made of 
the human capability for error recovery, much work 
has to be done in this area. It should not be forgotten 
that emergency planning is dominated by individual 
and organisational performance as well as the response 
of those affected by the hazard. Again, there is much 
work to be done in this area. 

It is fortunate that both in the UK and internationally 
there are now attempts to bring order to the whole 
area of human factors research but the problem of 
applying the outcomes by industry has yet to be 
tackled. 
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Appendix 14 Com uterised ism banks for 
major hazard incidents 



— all HSE) 



(by G Bagshaw, Dr B A Maguire and Dr C Nussey 

Introduction 

A recurring theme in the many discussions of Group D 
of the ACMH has been the concern that vital 
information, knowledge and experience regarding 
major hazards may not be available to be applied in 
particular situations for a variety of reasons; these 
include the possibility that the knowledge has been 
forgotten possibly as a result of retirements or 
transfers of staff etc. Sometimes, the knowledge may 
be available but not known about or easily accessible 
by the person needing it. For example, it may be 
buried in filing systems, archives and libraries from 
which if sufficient time and effort are available it 
could be retrieved. In some cases, there is a lack of 
will to extract data because the effort is too great and 
the immediate incentives not sufficiently great for the 
organisation to allocate the necessary resources. 

This problem is not, of course, unique to information 
on major hazards but is common to many areas of 
human knowledge where large amounts of information 
and data have been accumulated over the years. The 
modern approach to such problems is to computerise 
the information into a database which allows the 
information to be searched quickly by the associated 
information-retrieval programs, ie software. For 
example, many libraries, including those in HSE, are 
now using databases for storing large amounts of 
information and to enable literature searches to be 
conducted efficiently and quickly. This paper considers 
the use of information storage and retrieval systems 
for major hazard applications. 

Information retrieval techniques 

The main advantage of computer-based information- 
retrieval systems is that they allow large databases to 
be searched quickly and retrieve and list those items 
which are of interest to the user. Such facilities are 
achieved either by making use of a general-purpose 
information-retrieval system, or by writing special- 
purpose software to satisfy the specific needs of the 
application (such software often makes use of database 
management systems provided by computer 
manufacturers etc). The former technique allows 
systems to be set up quickly with little programming 
effort, provides great flexibility but can be relatively 
costly in terms of usage of computer resources. 

The latter technique tends to make more efficient 
usage of computer resources but systems can be 
expensive to set up and may suffer from lack of 
flexibility. Examples of general-purpose systems are 
Harwell’s STATUS (AERE, 1982) and ICI’S IRIS 
(Flynn and Wild 1977), STATUS is used in HSE 
Library Catalogue, LIBCAT, which contains about 



32000 references at the present time. LIBCAT will 
contain of course some bibliographic references to 
published material relating to major hazards but as it 
was designed as a general-purpose library system, this 
material is not comprehensive. 

Bibliographic references are only one source of useful 
information. In the next section, consideration is given 
to what information might be required in the area of 
major hazards. 



What information is needed on major hazards? 

The type of information needed about major hazards 
will depend on who wants it and why they want it. 
These questions need to be answered before a 
comprehensive answer can be given about what is 
required and how it can be stored and retrieved. Thus, 
it is unlikely that any one system could meet the needs 
of industry and an enforcing organisation such as 
HSE. 

For example, industry may need information on major 
hazards to assist in matters such as: 

(a) the design of safe plants (learning from past 
experience to prevent major incidents); 

(b) the provision of material for training of 
personnel; 

(c) the preparation of risk assessments; 

(d) the provision of necessary protection to plant 
personnel and members of the public; 

(e) devising evacuation and emergency action plans, 
and 

(f) furthering the understanding of the control of 
major hazards. 

On the other hand, HSE may need information on 
major hazards for reasons such as the following: 

(a) to assist in discharging its duties under the 
HSW Act and specifically the Notification of 
Installations Handling Hazardous Substances 
Regulations, 1982; 

(b) to assist in discharging its duties under the 
forthcoming EC Directive on major hazards 
(information implicit in Appendices 2 and 3 of 
the forthcoming regulations would be required); 

(c) tor training and current awareness purposes; 

(d) tor assisting with the validation of assessments 
submitted by industry; 

(e) to qid decision-making and policy-development; 
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(f) to assist in its advisory role to local planning 
authorities and to ensure consistency of that 
advice; 

(g) to assist with the validation of techniques being 
developed for (d) (e) and (f), and 

(h) for assisting with its own risk assessment. 

Although these lists are not exhaustive, they 
demonstrate that there are differences between the two 
requirements but that there are areas where the type of 
information needed is very similar. These areas of 
common interest can be divided into the following 
four general but dissimilar types: 

(a) detailed information about past incidents such as 
what went wrong and why, what happened next, 
details of casualties, consequences and 
ameliorating factors etc; 

(b) probability data for the various failure modes 
identified by (a) or some other means, e.g. 

HAZOP study (Lawley, 1974); 

(c) experimental and investigative data designed to 
augment and further the understanding of the 
causes and consequences of incidents (e.g. large- 
scale dispersion trials, radiation from pool fires, 
burning rates of flammable vapour clouds, etc), 
and 

(d) chemical properties (including toxicity) and 
physical properties of the substances involved. 

To the authors’ knowledge, purpose-designed 
commercial databases exist for all of these types of 
data, except that of type (c) where, to some extent, 
some published material can be identified through 
databases such as LIBCAT provided that the 
publications have been catalogued. There is, perhaps, a 
need to integrate such data into other databases or 
establish a new database on the line undertaken by 
workers in the area of complex turbulent flow 
(McQuaid, 1982). Examples of existing databases in 
these and other areas are given later but, before 
reviewing these, a short discussion on the quality and 
storage of incident data will be made to give 
perspective to the general problems being considered. 

The quality and storage of data on incidents 

At present, information on incidents derives from a 
variety of sources ranging from police, fire-brigades, 
companies, insurance and governmental organisations 
and public inquiries to press cuttings and eye witness 
accounts. This information is consequently of a 
variable quality. In the case of public enquiries, the 
information is likely to be detailed and verbose; with 
press cuttings the data may be incomplete, sometimes 
biased and even unreliable or inadequate. Therelore, 
care must be taken to ensure that data used on 
incidents is of the minimum standard acceptable tor 
the particular database. This information can, in 
general, be divided into two broad types: textual 



(narrative accounts) and numeric (dates, times, 
quantities etc). 

The way in which this information is used to create a 
database on hazardous incidents will be largely 
determined by the objectives laid down for the 
database as determined by user requirement (ie who 
wants it and why). Specification of the user 
requirement is by no means a simple task and must 
take into account the availability of data, the cost of 
computerising, storing and retrieving the information, 
the availability of suitable software and the benefits 
likely to be derived from a particular need. 

The user requirement, in essence, determines the 
structure of the database and the types of software 
that will be suitable to manage the database and 
retrieve data from it. In the case of an incidents 
database, it would be expected that information should 
concentrate mainly on causes and consequences and 
the associated factors. 

Although such information may be described in 
narrative accounts, the retrieval of relevant documents 
to some extent is hindered by the variety of ways in 
which it is possible to describe essentially similar 
events. It will therefore, be usually necessary to bring 
some degree of structure to the database so as to 
provide a high degree of recall (i.e. to retrieve all 
relevant incidents) coupled with a high degree of 
precision (minimal useless information, i.e. ‘false 
drops’). This structure can be provided by including 
user-defined keywords or classifications in the form of 
numeric codes so that important characteristics of the 
incident can be readily identified. The extent to which 
structure can be included in the database is determined 
by the capability of the software to be used in 
handling such information and the availability of 
resources for conducting the associated labour 
intensive pre-processing of the data. 

Numerical structured (coded) information can be used 
for readily producing statistical summaries of incidents 
which would be more laborious to produce if the 
database were of a largely unstructured form. In 
addition, coded data can be stored much more 
efficiently on a computer. However, structuring the 
data in this way presents other problems apart from 
that of effort. It is a source of error and much 
professional judgement is required if a consistent 
approach is to be maintained in classifying 
information which is written in a variety of styles and 
levels of detail. 

At present, the standards of reporting incidents vary 
almost as widely as the type of incidents themselves 
and one desirable pre-requisite ot a data storage 
system would be some agreed form of incident 
reporting, possibly on the lines of those proposed by 
Roberts (1980). There is no doubt that such a proposal, 
if adopted internationally, would greatly improve the 
quality of information on incidents. However, an 
internationally agreed reporting form would probably 
need the support of the United Nations agencies and is 
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likely to take some considerable time to achieve. 
However limited progress through the ECSC may be 
possible. 

Some existing databases 

The authors cannot claim to have made an extensive 
survey of all relevant databases but the following give 
some idea of the situation in the UK. 

(a) Incident databases 

There are at least two commercial databases which 
claim to provide international coverage of incidents 
etc. One is the TNO Industrial Safety Databank 
(called FACTS) which is based in Apeldoorn, Holland 
(Bockholts, 1982). This is an off-line service, enquiries 
being made by telephone, telex or letter. The other is 
the CHAFINCH (1982) system provided by the 
commercial bureau SI A Computer Service in the UK. 

The suppliers of CHAFINCH claim that the database 
contains information on “chemical accidents, failure 
incidents and chemical hazards providing international 
coverage of transportation, storage and processing of 
oil, gas, petrochemicals and other hazardous 
substances”. CHAFINCH is an on-line system held on 
SIA’s IBM mainframe computer which is accessed by 
computer terminals via the public telephone network. 

In October 1981, the database contained information 
on 640 incidents. 

(b) Event probability databases 

The National Centre for Systems Reliability of the 
UKAEA’s Safety and Reliability Directorate has, since 
1960, maintained and updated a database containing 
reliability data for a wide range of nuclear, chemical 
and other plant components. The database is known 
as the Systems Reliability Service (SRS) Data Bank 
and is in two main parts: the Event Data Store and 
the Reliability Data Store (SRS, 1980). It provides 
information to the contributors of data on the 
performance, availability and reliability of their own 
plants and generic reliability data for use in SRS 
studies or by associate members of SRS. Currently, the 
database contains about 10 000 entries covering over a 
quarter of a million failures (SRS, 1982). 

FACTS also offers data for probability calculations. 

(c) Property databases 

Two UK databases of this type are known to the 
authors. The one used currently within HSE is 
Physical Property Data Service (PPDS) which is 
maintained by the Institution of Chemical Engineers 
and is available through a number of commercial 
bureaux. PPDS will supply properties of pure 
compounds and calculate the properties of mixtures 
using standard mixing rules. The data have been 
derived by evaluation of published and unpublished 
data, from sponsored experimental work and from 
estimation using the best predictive methods available. 
(If one is only interested in pure compounds, it is 
usually more efficient to look them up in a reference 
work.) 



A similar type of database is HAZCHEM which is 
maintained by AERE Harwell. 

In addition, HSE are also using the American Society 
for Testing Materials’ computer program CHETAH 
(CHEmical Thermodynamics And energy Hazard 
evaluation) for calculation or estimation of 
thermodynamic properties and the calculation of the 
maximum possible energy release from a chemical 
reaction (Treweek et al 1978). 

(d) Other databases 

One other database which will be available in January 
1983 is ECDIN which has been established by the 
Joint Research Centre of the Commission of the 
European Committees at Ispra, Italy. ECDIN 
(Environmental Chemical Data Information Network) 
will provide information on environmental chemicals 
including toxicological effects, manufacturing 
locations, production and/or consumption figures, 
counter measures and relevant accidents). 

This database should usefully augment FACTS and 
CHAFINCH. 

The Major Hazards Assessment Unit is maintaining, 
under the STATUS system, its own database on 
notifiable sites (HAZINST), the database being 
currently structured around the proposed Hazardous 
Installations (Notification and Survey) Regulations of 
1978. 

Conclusions 

(a) There would appear to be a number of useful 
databases already in existence that will meet 
some of the needs of potential users of 
information on major hazards. 

(b) The most useful databases identified from this 
survey and within Europe which are generally 
available are FACTS, CHAFINCH, SRS 
Reliability Data Store, PPDS, HAZCHEM and 
ECDIN. Equivalent databases are likely to exist 
in the USA. 

(c) The needs in the areas of physical and chemical 
properties seem equally catered for by 
HAZCHEM, PPDS and published reference 
works. The weakest area would seem to be the 
toxicological one. 

(d) There will always be a need for organisations to 
maintain, normally or otherwise, purpose- 
designed information systems to meet their own 
needs. However, we feel that the number and 
extent of these can be greatly reduced if the 
claims made for the commercially available 
databases, such as FACTS, CHAFINCH and 
ECDIN, materialise. 

(e) Should a purpose-designed information system be 
needed, we feel that in most cases it could be 
based on general purpose software (eg STATUS, 
(AERE, 1982)) or a system-specific database 
management system.) 
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(f) We do not claim that this paper covers all angles 
of the problem or that an in-depth survey of the 
area has been undertaken. 
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